@korayda4/vibe-security 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (183) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +240 -0
  3. package/dist/cli.d.ts +2 -0
  4. package/dist/cli.js +333 -0
  5. package/dist/cli.js.map +1 -0
  6. package/dist/engine/baseline.d.ts +19 -0
  7. package/dist/engine/baseline.js +48 -0
  8. package/dist/engine/baseline.js.map +1 -0
  9. package/dist/engine/config.d.ts +26 -0
  10. package/dist/engine/config.js +41 -0
  11. package/dist/engine/config.js.map +1 -0
  12. package/dist/engine/fixer.d.ts +22 -0
  13. package/dist/engine/fixer.js +87 -0
  14. package/dist/engine/fixer.js.map +1 -0
  15. package/dist/engine/language.d.ts +27 -0
  16. package/dist/engine/language.js +364 -0
  17. package/dist/engine/language.js.map +1 -0
  18. package/dist/engine/output.d.ts +6 -0
  19. package/dist/engine/output.js +155 -0
  20. package/dist/engine/output.js.map +1 -0
  21. package/dist/engine/reporter.d.ts +3 -0
  22. package/dist/engine/reporter.js +145 -0
  23. package/dist/engine/reporter.js.map +1 -0
  24. package/dist/engine/rules/_helpers.d.ts +9 -0
  25. package/dist/engine/rules/_helpers.js +64 -0
  26. package/dist/engine/rules/_helpers.js.map +1 -0
  27. package/dist/engine/rules/backend/fileUpload.d.ts +3 -0
  28. package/dist/engine/rules/backend/fileUpload.js +40 -0
  29. package/dist/engine/rules/backend/fileUpload.js.map +1 -0
  30. package/dist/engine/rules/backend/hashing.d.ts +3 -0
  31. package/dist/engine/rules/backend/hashing.js +40 -0
  32. package/dist/engine/rules/backend/hashing.js.map +1 -0
  33. package/dist/engine/rules/backend/idor.d.ts +3 -0
  34. package/dist/engine/rules/backend/idor.js +40 -0
  35. package/dist/engine/rules/backend/idor.js.map +1 -0
  36. package/dist/engine/rules/backend/index.d.ts +12 -0
  37. package/dist/engine/rules/backend/index.js +22 -0
  38. package/dist/engine/rules/backend/index.js.map +1 -0
  39. package/dist/engine/rules/backend/inputValidation.d.ts +3 -0
  40. package/dist/engine/rules/backend/inputValidation.js +37 -0
  41. package/dist/engine/rules/backend/inputValidation.js.map +1 -0
  42. package/dist/engine/rules/backend/jwt.d.ts +3 -0
  43. package/dist/engine/rules/backend/jwt.js +42 -0
  44. package/dist/engine/rules/backend/jwt.js.map +1 -0
  45. package/dist/engine/rules/backend/rateLimit.d.ts +3 -0
  46. package/dist/engine/rules/backend/rateLimit.js +45 -0
  47. package/dist/engine/rules/backend/rateLimit.js.map +1 -0
  48. package/dist/engine/rules/backend/sqlInjection.d.ts +3 -0
  49. package/dist/engine/rules/backend/sqlInjection.js +41 -0
  50. package/dist/engine/rules/backend/sqlInjection.js.map +1 -0
  51. package/dist/engine/rules/backend/tokenExpiry.d.ts +3 -0
  52. package/dist/engine/rules/backend/tokenExpiry.js +85 -0
  53. package/dist/engine/rules/backend/tokenExpiry.js.map +1 -0
  54. package/dist/engine/rules/backend/tokenInUrl.d.ts +3 -0
  55. package/dist/engine/rules/backend/tokenInUrl.js +112 -0
  56. package/dist/engine/rules/backend/tokenInUrl.js.map +1 -0
  57. package/dist/engine/rules/cicd/dependencies.d.ts +3 -0
  58. package/dist/engine/rules/cicd/dependencies.js +44 -0
  59. package/dist/engine/rules/cicd/dependencies.js.map +1 -0
  60. package/dist/engine/rules/cicd/dockerfile.d.ts +3 -0
  61. package/dist/engine/rules/cicd/dockerfile.js +42 -0
  62. package/dist/engine/rules/cicd/dockerfile.js.map +1 -0
  63. package/dist/engine/rules/cicd/index.d.ts +6 -0
  64. package/dist/engine/rules/cicd/index.js +10 -0
  65. package/dist/engine/rules/cicd/index.js.map +1 -0
  66. package/dist/engine/rules/cicd/secrets.d.ts +3 -0
  67. package/dist/engine/rules/cicd/secrets.js +41 -0
  68. package/dist/engine/rules/cicd/secrets.js.map +1 -0
  69. package/dist/engine/rules/database/encryption.d.ts +3 -0
  70. package/dist/engine/rules/database/encryption.js +37 -0
  71. package/dist/engine/rules/database/encryption.js.map +1 -0
  72. package/dist/engine/rules/database/index.d.ts +5 -0
  73. package/dist/engine/rules/database/index.js +8 -0
  74. package/dist/engine/rules/database/index.js.map +1 -0
  75. package/dist/engine/rules/database/privileges.d.ts +3 -0
  76. package/dist/engine/rules/database/privileges.js +40 -0
  77. package/dist/engine/rules/database/privileges.js.map +1 -0
  78. package/dist/engine/rules/frontend/clickjacking.d.ts +3 -0
  79. package/dist/engine/rules/frontend/clickjacking.js +41 -0
  80. package/dist/engine/rules/frontend/clickjacking.js.map +1 -0
  81. package/dist/engine/rules/frontend/cookies.d.ts +3 -0
  82. package/dist/engine/rules/frontend/cookies.js +35 -0
  83. package/dist/engine/rules/frontend/cookies.js.map +1 -0
  84. package/dist/engine/rules/frontend/envVars.d.ts +3 -0
  85. package/dist/engine/rules/frontend/envVars.js +34 -0
  86. package/dist/engine/rules/frontend/envVars.js.map +1 -0
  87. package/dist/engine/rules/frontend/eval.d.ts +3 -0
  88. package/dist/engine/rules/frontend/eval.js +35 -0
  89. package/dist/engine/rules/frontend/eval.js.map +1 -0
  90. package/dist/engine/rules/frontend/index.d.ts +9 -0
  91. package/dist/engine/rules/frontend/index.js +16 -0
  92. package/dist/engine/rules/frontend/index.js.map +1 -0
  93. package/dist/engine/rules/frontend/sourceMaps.d.ts +3 -0
  94. package/dist/engine/rules/frontend/sourceMaps.js +79 -0
  95. package/dist/engine/rules/frontend/sourceMaps.js.map +1 -0
  96. package/dist/engine/rules/frontend/xss.d.ts +3 -0
  97. package/dist/engine/rules/frontend/xss.js +70 -0
  98. package/dist/engine/rules/frontend/xss.js.map +1 -0
  99. package/dist/engine/rules/index.d.ts +8 -0
  100. package/dist/engine/rules/index.js +38 -0
  101. package/dist/engine/rules/index.js.map +1 -0
  102. package/dist/engine/rules/kotlin/index.d.ts +5 -0
  103. package/dist/engine/rules/kotlin/index.js +8 -0
  104. package/dist/engine/rules/kotlin/index.js.map +1 -0
  105. package/dist/engine/rules/kotlin/kotlinxHtml.d.ts +3 -0
  106. package/dist/engine/rules/kotlin/kotlinxHtml.js +54 -0
  107. package/dist/engine/rules/kotlin/kotlinxHtml.js.map +1 -0
  108. package/dist/engine/rules/kotlin/sqlInjection.d.ts +3 -0
  109. package/dist/engine/rules/kotlin/sqlInjection.js +57 -0
  110. package/dist/engine/rules/kotlin/sqlInjection.js.map +1 -0
  111. package/dist/engine/rules/network/cors.d.ts +3 -0
  112. package/dist/engine/rules/network/cors.js +106 -0
  113. package/dist/engine/rules/network/cors.js.map +1 -0
  114. package/dist/engine/rules/network/headers.d.ts +3 -0
  115. package/dist/engine/rules/network/headers.js +51 -0
  116. package/dist/engine/rules/network/headers.js.map +1 -0
  117. package/dist/engine/rules/network/index.d.ts +6 -0
  118. package/dist/engine/rules/network/index.js +10 -0
  119. package/dist/engine/rules/network/index.js.map +1 -0
  120. package/dist/engine/rules/network/tls.d.ts +3 -0
  121. package/dist/engine/rules/network/tls.js +40 -0
  122. package/dist/engine/rules/network/tls.js.map +1 -0
  123. package/dist/engine/rules/observability/errorHandler.d.ts +3 -0
  124. package/dist/engine/rules/observability/errorHandler.js +34 -0
  125. package/dist/engine/rules/observability/errorHandler.js.map +1 -0
  126. package/dist/engine/rules/observability/index.d.ts +5 -0
  127. package/dist/engine/rules/observability/index.js +8 -0
  128. package/dist/engine/rules/observability/index.js.map +1 -0
  129. package/dist/engine/rules/observability/logging.d.ts +3 -0
  130. package/dist/engine/rules/observability/logging.js +38 -0
  131. package/dist/engine/rules/observability/logging.js.map +1 -0
  132. package/dist/engine/rules/php/index.d.ts +6 -0
  133. package/dist/engine/rules/php/index.js +10 -0
  134. package/dist/engine/rules/php/index.js.map +1 -0
  135. package/dist/engine/rules/php/sqlInjection.d.ts +3 -0
  136. package/dist/engine/rules/php/sqlInjection.js +58 -0
  137. package/dist/engine/rules/php/sqlInjection.js.map +1 -0
  138. package/dist/engine/rules/php/weakHashing.d.ts +3 -0
  139. package/dist/engine/rules/php/weakHashing.js +36 -0
  140. package/dist/engine/rules/php/weakHashing.js.map +1 -0
  141. package/dist/engine/rules/php/xss.d.ts +3 -0
  142. package/dist/engine/rules/php/xss.js +56 -0
  143. package/dist/engine/rules/php/xss.js.map +1 -0
  144. package/dist/engine/rules/ruby/index.d.ts +6 -0
  145. package/dist/engine/rules/ruby/index.js +10 -0
  146. package/dist/engine/rules/ruby/index.js.map +1 -0
  147. package/dist/engine/rules/ruby/sqlInjection.d.ts +3 -0
  148. package/dist/engine/rules/ruby/sqlInjection.js +56 -0
  149. package/dist/engine/rules/ruby/sqlInjection.js.map +1 -0
  150. package/dist/engine/rules/ruby/strongParams.d.ts +3 -0
  151. package/dist/engine/rules/ruby/strongParams.js +35 -0
  152. package/dist/engine/rules/ruby/strongParams.js.map +1 -0
  153. package/dist/engine/rules/ruby/xss.d.ts +3 -0
  154. package/dist/engine/rules/ruby/xss.js +55 -0
  155. package/dist/engine/rules/ruby/xss.js.map +1 -0
  156. package/dist/engine/rules/rust/index.d.ts +6 -0
  157. package/dist/engine/rules/rust/index.js +10 -0
  158. package/dist/engine/rules/rust/index.js.map +1 -0
  159. package/dist/engine/rules/rust/secretInCode.d.ts +3 -0
  160. package/dist/engine/rules/rust/secretInCode.js +36 -0
  161. package/dist/engine/rules/rust/secretInCode.js.map +1 -0
  162. package/dist/engine/rules/rust/sqlInjection.d.ts +3 -0
  163. package/dist/engine/rules/rust/sqlInjection.js +55 -0
  164. package/dist/engine/rules/rust/sqlInjection.js.map +1 -0
  165. package/dist/engine/rules/rust/unsafeExpect.d.ts +3 -0
  166. package/dist/engine/rules/rust/unsafeExpect.js +56 -0
  167. package/dist/engine/rules/rust/unsafeExpect.js.map +1 -0
  168. package/dist/engine/scanner.d.ts +5 -0
  169. package/dist/engine/scanner.js +135 -0
  170. package/dist/engine/scanner.js.map +1 -0
  171. package/dist/engine/walker.d.ts +11 -0
  172. package/dist/engine/walker.js +90 -0
  173. package/dist/engine/walker.js.map +1 -0
  174. package/dist/index.d.ts +2 -0
  175. package/dist/index.js +7 -0
  176. package/dist/index.js.map +1 -0
  177. package/dist/server.d.ts +36 -0
  178. package/dist/server.js +360 -0
  179. package/dist/server.js.map +1 -0
  180. package/dist/types.d.ts +92 -0
  181. package/dist/types.js +2 -0
  182. package/dist/types.js.map +1 -0
  183. package/package.json +85 -0
@@ -0,0 +1,90 @@
1
+ import fs from 'node:fs/promises';
2
+ import path from 'node:path';
3
+ const DEFAULT_IGNORED_DIRS = new Set([
4
+ 'node_modules',
5
+ '.git',
6
+ '.next',
7
+ '.nuxt',
8
+ 'dist',
9
+ 'build',
10
+ 'coverage',
11
+ '.cache',
12
+ '.turbo',
13
+ '.vercel',
14
+ '.output',
15
+ 'out',
16
+ 'vendor',
17
+ 'target',
18
+ '__pycache__',
19
+ '.pytest_cache',
20
+ '.mypy_cache',
21
+ '.venv',
22
+ 'venv',
23
+ '.gradle',
24
+ '.idea',
25
+ '.vscode',
26
+ '.DS_Store',
27
+ ]);
28
+ const MAX_FILE_SIZE = 2 * 1024 * 1024;
29
+ export async function walkProject(options) {
30
+ const { rootDir } = options;
31
+ const userIgnore = new Set(options.ignore ?? []);
32
+ const maxFiles = options.maxFiles ?? 10_000;
33
+ const results = [];
34
+ async function visit(dir) {
35
+ if (results.length >= maxFiles)
36
+ return;
37
+ let entries;
38
+ try {
39
+ entries = await fs.readdir(dir, { withFileTypes: true });
40
+ }
41
+ catch {
42
+ return;
43
+ }
44
+ for (const entry of entries) {
45
+ if (results.length >= maxFiles)
46
+ return;
47
+ const name = entry.name;
48
+ if (userIgnore.has(name) || userIgnore.has(`**/${name}`) || userIgnore.has(`**/${name}/**`)) {
49
+ continue;
50
+ }
51
+ const full = path.join(dir, name);
52
+ const rel = path.relative(rootDir, full);
53
+ if (entry.isDirectory()) {
54
+ if (DEFAULT_IGNORED_DIRS.has(name) ||
55
+ (name.startsWith('.') &&
56
+ name !== '.env' &&
57
+ name !== '.env.example' &&
58
+ name !== '.gitignore')) {
59
+ continue;
60
+ }
61
+ await visit(full);
62
+ continue;
63
+ }
64
+ if (!entry.isFile())
65
+ continue;
66
+ if (name.startsWith('.')) {
67
+ const allowed = name === '.env' || name === '.env.example' || name === '.gitignore' || name === '.dockerignore';
68
+ if (!allowed)
69
+ continue;
70
+ }
71
+ let stat;
72
+ try {
73
+ stat = await fs.stat(full);
74
+ }
75
+ catch {
76
+ continue;
77
+ }
78
+ if (stat.size > MAX_FILE_SIZE)
79
+ continue;
80
+ results.push({
81
+ absolutePath: full,
82
+ relativePath: rel.split(path.sep).join('/'),
83
+ sizeBytes: stat.size,
84
+ });
85
+ }
86
+ }
87
+ await visit(rootDir);
88
+ return results;
89
+ }
90
+ //# sourceMappingURL=walker.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"walker.js","sourceRoot":"","sources":["../../src/engine/walker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,cAAc;IACd,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;IACT,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,eAAe;IACf,aAAa;IACb,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAoB;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAE5C,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,KAAK,UAAU,KAAK,CAAC,GAAW;QAC9B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QAEvC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;gBAAE,OAAO;YAEvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC5F,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAEzC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IACE,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC9B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;wBACnB,IAAI,KAAK,MAAM;wBACf,IAAI,KAAK,cAAc;wBACvB,IAAI,KAAK,YAAY,CAAC,EACxB,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAE9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,OAAO,GACX,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,eAAe,CAAC;gBAClG,IAAI,CAAC,OAAO;oBAAE,SAAS;YACzB,CAAC;YAED,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;gBAAE,SAAS;YAExC,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC3C,SAAS,EAAE,IAAI,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -0,0 +1,2 @@
1
+ #!/usr/bin/env node
2
+ export {};
package/dist/index.js ADDED
@@ -0,0 +1,7 @@
1
+ #!/usr/bin/env node
2
+ import { startServer } from './server.js';
3
+ startServer().catch((err) => {
4
+ console.error('[vibe-security] Fatal:', err);
5
+ process.exit(1);
6
+ });
7
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC1B,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
@@ -0,0 +1,36 @@
1
+ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
2
+ export declare const server: Server<{
3
+ method: string;
4
+ params?: {
5
+ [x: string]: unknown;
6
+ _meta?: {
7
+ [x: string]: unknown;
8
+ progressToken?: string | number | undefined;
9
+ "io.modelcontextprotocol/related-task"?: {
10
+ taskId: string;
11
+ } | undefined;
12
+ } | undefined;
13
+ } | undefined;
14
+ }, {
15
+ method: string;
16
+ params?: {
17
+ [x: string]: unknown;
18
+ _meta?: {
19
+ [x: string]: unknown;
20
+ progressToken?: string | number | undefined;
21
+ "io.modelcontextprotocol/related-task"?: {
22
+ taskId: string;
23
+ } | undefined;
24
+ } | undefined;
25
+ } | undefined;
26
+ }, {
27
+ [x: string]: unknown;
28
+ _meta?: {
29
+ [x: string]: unknown;
30
+ progressToken?: string | number | undefined;
31
+ "io.modelcontextprotocol/related-task"?: {
32
+ taskId: string;
33
+ } | undefined;
34
+ } | undefined;
35
+ }>;
36
+ export declare function startServer(): Promise<void>;
package/dist/server.js ADDED
@@ -0,0 +1,360 @@
1
+ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
2
+ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
3
+ import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
4
+ import { scan } from './engine/scanner.js';
5
+ import { writeSecurityReport } from './engine/reporter.js';
6
+ import { getAllRules, getRuleById } from './engine/rules/index.js';
7
+ export const server = new Server({
8
+ name: 'vibe-security',
9
+ version: '0.1.0',
10
+ }, {
11
+ capabilities: {
12
+ tools: {},
13
+ },
14
+ });
15
+ server.setRequestHandler(ListToolsRequestSchema, async () => {
16
+ return {
17
+ tools: [
18
+ {
19
+ name: 'scan_project',
20
+ description: 'Scan the entire project. Applies all rules, categorizes findings, and optionally writes a Security.md report.',
21
+ inputSchema: {
22
+ type: 'object',
23
+ properties: {
24
+ rootDir: {
25
+ type: 'string',
26
+ description: 'Directory to scan (default: cwd)',
27
+ },
28
+ layers: {
29
+ type: 'array',
30
+ items: {
31
+ type: 'string',
32
+ enum: ['frontend', 'backend', 'network', 'database', 'cicd', 'observability'],
33
+ },
34
+ description: 'Limit the scan to these layers',
35
+ },
36
+ languages: {
37
+ type: 'array',
38
+ items: { type: 'string' },
39
+ description: 'Belirli dillere kisitla (javascript, python, java, go, vb.)',
40
+ },
41
+ ruleIds: {
42
+ type: 'array',
43
+ items: { type: 'string' },
44
+ description: 'Sadece belirli kurallari calistir (ornek: ["BE-004", "FE-001"])',
45
+ },
46
+ writeReport: {
47
+ type: 'boolean',
48
+ description: 'Security.md dosyasi yaz (default: true)',
49
+ default: true,
50
+ },
51
+ reportPath: {
52
+ type: 'string',
53
+ description: 'Security.md cikti yolu (default: <rootDir>/Security.md)',
54
+ },
55
+ maxMatchesPerFile: {
56
+ type: 'number',
57
+ description: 'Dosya basina maks. eslesme (default: 50)',
58
+ },
59
+ ignore: {
60
+ type: 'array',
61
+ items: { type: 'string' },
62
+ description: 'Glob patterns to ignore',
63
+ },
64
+ baselinePath: {
65
+ type: 'string',
66
+ description: 'Baseline file -- show only NEW findings',
67
+ },
68
+ includeFixes: {
69
+ type: 'boolean',
70
+ description: 'Also summarize auto-fixable findings',
71
+ default: false,
72
+ },
73
+ },
74
+ required: [],
75
+ },
76
+ },
77
+ {
78
+ name: 'scan_file',
79
+ description: 'Scan a single file with selected rules. Use this to validate a specific finding or quickly check a newly-added file.',
80
+ inputSchema: {
81
+ type: 'object',
82
+ required: ['filePath'],
83
+ properties: {
84
+ filePath: {
85
+ type: 'string',
86
+ description: 'Absolute path of the file to scan',
87
+ },
88
+ layers: {
89
+ type: 'array',
90
+ items: { type: 'string' },
91
+ },
92
+ ruleIds: {
93
+ type: 'array',
94
+ items: { type: 'string' },
95
+ },
96
+ },
97
+ },
98
+ },
99
+ {
100
+ name: 'list_rules',
101
+ description: 'Mevcut tum guvenlik kurallarini listeler. ID, katman, severity, baslik ve dil destegi icerir.',
102
+ inputSchema: {
103
+ type: 'object',
104
+ properties: {
105
+ layer: {
106
+ type: 'string',
107
+ enum: ['frontend', 'backend', 'network', 'database', 'cicd', 'observability'],
108
+ description: 'Belirli bir katmana filtrele',
109
+ },
110
+ },
111
+ },
112
+ },
113
+ {
114
+ name: 'get_rule_detail',
115
+ description: 'Belirli bir kural hakkinda tam detay: aciklama, tehdit, onlem, referanslar, ornek desenler.',
116
+ inputSchema: {
117
+ type: 'object',
118
+ required: ['ruleId'],
119
+ properties: {
120
+ ruleId: {
121
+ type: 'string',
122
+ description: 'Kural ID (ornek: "BE-004", "FE-001")',
123
+ },
124
+ },
125
+ },
126
+ },
127
+ ],
128
+ };
129
+ });
130
+ server.setRequestHandler(CallToolRequestSchema, async (request) => {
131
+ const { name, arguments: args } = request.params;
132
+ switch (name) {
133
+ case 'scan_project': {
134
+ const params = (args ?? {});
135
+ const opts = {
136
+ rootDir: params.rootDir ?? process.cwd(),
137
+ layers: params.layers,
138
+ languages: params.languages,
139
+ ruleIds: params.ruleIds,
140
+ maxMatchesPerFile: params.maxMatchesPerFile,
141
+ ignore: params.ignore,
142
+ };
143
+ const result = await scan(opts);
144
+ let displayFindings = result.findings;
145
+ if (params.baselinePath) {
146
+ const { readBaseline, diffAgainstBaseline } = await import('./engine/baseline.js');
147
+ const baseline = await readBaseline(params.baselinePath);
148
+ const diff = diffAgainstBaseline(result, baseline);
149
+ displayFindings = diff.newFindings;
150
+ }
151
+ let reportPath;
152
+ const writeReport = params.writeReport !== false;
153
+ if (writeReport) {
154
+ const filtered = { ...result, findings: displayFindings };
155
+ reportPath = await writeSecurityReport(filtered, params.reportPath ?? `${result.rootDir}/Security.md`);
156
+ }
157
+ const summary = formatSummary({ ...result, findings: displayFindings });
158
+ const profileSection = result.profile
159
+ ? `\n## Project Profile\n\n- **Primary language:** \`${result.profile.primary}\`\n- **Languages detected:** ${result.profile.detected.map((l) => `\`${l}\``).join(', ')}\n- **Applicable rules:** ${result.profile.applicableRules.length}\n`
160
+ : '';
161
+ const topFindings = displayFindings
162
+ .slice()
163
+ .sort((a, b) => severityRank(a.severity) - severityRank(b.severity))
164
+ .slice(0, 30);
165
+ const fixable = params.includeFixes
166
+ ? displayFindings.filter((f) => f.fix).slice(0, 10)
167
+ : [];
168
+ const text = [
169
+ summary,
170
+ '',
171
+ reportPath ? `📝 Report written to: \`${reportPath}\`` : '',
172
+ params.baselinePath ? `\n📋 Baseline diff: showing only NEW findings` : '',
173
+ '',
174
+ '## Top Findings',
175
+ '',
176
+ topFindings
177
+ .map((f) => `- **${f.severity.toUpperCase()}** [\`${f.ruleId}\`] ${f.title} -- \`${f.file}:${f.match.line}\`${f.fix ? ' 🔧' : ''}`)
178
+ .join('\n'),
179
+ displayFindings.length > 30
180
+ ? `\n\n...and ${displayFindings.length - 30} more (see Security.md).`
181
+ : '',
182
+ fixable.length > 0
183
+ ? `\n\n## 🔧 Auto-fixable (${fixable.length})\n\n` +
184
+ fixable
185
+ .map((f) => `### [\`${f.ruleId}\`] ${f.file}:${f.match.line}\n${f.fix.description}\n`)
186
+ .join('\n')
187
+ : '',
188
+ fixable.length > 0
189
+ ? `\nKullanici isterse \`vibe-security scan . --fix --dry-run\` ile uygulayabilir.`
190
+ : '',
191
+ ]
192
+ .filter(Boolean)
193
+ .join('\n');
194
+ return {
195
+ content: [{ type: 'text', text }],
196
+ isError: false,
197
+ };
198
+ }
199
+ case 'scan_file': {
200
+ const params = (args ?? {});
201
+ if (!params.filePath) {
202
+ return errorResult('filePath is required');
203
+ }
204
+ const fs = await import('node:fs/promises');
205
+ const path = await import('node:path');
206
+ const { detectLanguage } = await import('./engine/language.js');
207
+ const { getRulesForLanguage } = await import('./engine/rules/index.js');
208
+ const { makeFinding } = await import('./engine/rules/_helpers.js');
209
+ let source;
210
+ try {
211
+ source = await fs.readFile(params.filePath, 'utf8');
212
+ }
213
+ catch (err) {
214
+ return errorResult(`Cannot read file: ${err.message}`);
215
+ }
216
+ const language = detectLanguage(params.filePath);
217
+ const candidates = getRulesForLanguage(language);
218
+ const applicable = candidates.filter((r) => {
219
+ if (params.ruleIds && !params.ruleIds.includes(r.id))
220
+ return false;
221
+ if (params.layers && !params.layers.includes(r.layer))
222
+ return false;
223
+ return true;
224
+ });
225
+ const lines = source.split(/\r?\n/);
226
+ const ctx = {
227
+ filePath: params.filePath,
228
+ relativePath: path.relative(process.cwd(), params.filePath),
229
+ language,
230
+ source,
231
+ lines,
232
+ };
233
+ const findings = [];
234
+ for (const rule of applicable) {
235
+ try {
236
+ for (const f of rule.check(ctx)) {
237
+ findings.push(f);
238
+ }
239
+ }
240
+ catch {
241
+ }
242
+ }
243
+ const formatted = findings.length
244
+ ? findings
245
+ .sort((a, b) => severityRank(a.severity) - severityRank(b.severity))
246
+ .map((f) => `- **${f.severity.toUpperCase()}** [\`${f.ruleId}\`] ${f.title}\n \`${f.file}:${f.match.line}\` -- ${f.match.snippet.trim().split('\n')[0]}`)
247
+ .join('\n')
248
+ : '✅ No findings for this file with the selected rules.';
249
+ return {
250
+ content: [
251
+ {
252
+ type: 'text',
253
+ text: `# File Scan -- ${path.basename(params.filePath)}\n\nLanguage: \`${language}\`\nRules applied: ${applicable.length}\nFindings: ${findings.length}\n\n${formatted}`,
254
+ },
255
+ ],
256
+ isError: false,
257
+ };
258
+ }
259
+ case 'list_rules': {
260
+ const params = (args ?? {});
261
+ const rules = params.layer
262
+ ? getAllRules().filter((r) => r.layer === params.layer)
263
+ : getAllRules();
264
+ const text = rules
265
+ .map((r) => `- [\`${r.id}\`] **${r.severity.toUpperCase()}** - ${r.layer} - ${r.title}\n Languages: ${r.languages.join(', ')}`)
266
+ .join('\n');
267
+ return {
268
+ content: [
269
+ {
270
+ type: 'text',
271
+ text: `# Available Security Rules\n\nTotal: ${rules.length}\n\n${text}`,
272
+ },
273
+ ],
274
+ isError: false,
275
+ };
276
+ }
277
+ case 'get_rule_detail': {
278
+ const params = (args ?? {});
279
+ const rule = getRuleById(params.ruleId);
280
+ if (!rule) {
281
+ return errorResult(`Rule not found: ${params.ruleId}`);
282
+ }
283
+ const text = [
284
+ `# ${rule.id} -- ${rule.title}`,
285
+ '',
286
+ `- **Layer:** ${rule.layer}`,
287
+ `- **Severity:** ${rule.severity}`,
288
+ rule.cwe ? `- **CWE:** ${rule.cwe}` : '',
289
+ rule.owasp ? `- **OWASP:** ${rule.owasp}` : '',
290
+ `- **Languages:** ${rule.languages.join(', ')}`,
291
+ '',
292
+ '## Description',
293
+ '',
294
+ rule.description,
295
+ '',
296
+ '## Threat / Impact',
297
+ '',
298
+ rule.threat,
299
+ '',
300
+ '## Remediation',
301
+ '',
302
+ rule.remediation,
303
+ '',
304
+ rule.references.length > 0
305
+ ? `## References\n\n${rule.references.map((r) => `- ${r}`).join('\n')}`
306
+ : '',
307
+ ]
308
+ .filter(Boolean)
309
+ .join('\n');
310
+ return {
311
+ content: [{ type: 'text', text }],
312
+ isError: false,
313
+ };
314
+ }
315
+ default:
316
+ return errorResult(`Unknown tool: ${name}`);
317
+ }
318
+ });
319
+ function severityRank(s) {
320
+ return { critical: 0, high: 1, medium: 2, low: 3, info: 4 }[s] ?? 5;
321
+ }
322
+ function formatSummary(result) {
323
+ const { bySeverity, byLayer } = result.summary;
324
+ const lines = [];
325
+ lines.push(`# 🛡️ Vibe Security Scan Complete`);
326
+ lines.push('');
327
+ lines.push(`- **Total findings:** ${result.summary.totalFindings}`);
328
+ lines.push(`- **Files scanned:** ${result.filesScanned}`);
329
+ lines.push(`- **Rules evaluated:** ${result.rulesEvaluated}`);
330
+ lines.push(`- **Duration:** ${result.durationMs}ms`);
331
+ lines.push('');
332
+ lines.push('## By severity');
333
+ lines.push('');
334
+ lines.push('| Severity | Count |');
335
+ lines.push('| --- | --- |');
336
+ for (const sev of ['critical', 'high', 'medium', 'low', 'info']) {
337
+ lines.push(`| ${sev} | ${bySeverity[sev] ?? 0} |`);
338
+ }
339
+ lines.push('');
340
+ lines.push('## By layer');
341
+ lines.push('');
342
+ lines.push('| Layer | Count |');
343
+ lines.push('| --- | --- |');
344
+ for (const layer of ['frontend', 'backend', 'network', 'database', 'cicd', 'observability']) {
345
+ lines.push(`| ${layer} | ${byLayer[layer] ?? 0} |`);
346
+ }
347
+ return lines.join('\n');
348
+ }
349
+ function errorResult(message) {
350
+ return {
351
+ content: [{ type: 'text', text: `❌ ${message}` }],
352
+ isError: true,
353
+ };
354
+ }
355
+ export async function startServer() {
356
+ const transport = new StdioServerTransport();
357
+ await server.connect(transport);
358
+ console.error('[vibe-security] MCP server running on stdio');
359
+ }
360
+ //# sourceMappingURL=server.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAGnE,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,MAAM,CAC9B;IACE,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;IAC1D,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,cAAc;gBACpB,WAAW,EACT,+GAA+G;gBACjH,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,kCAAkC;yBAChD;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC;6BAC9E;4BACD,WAAW,EAAE,gCAAgC;yBAC9C;wBACD,SAAS,EAAE;4BACT,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACzB,WAAW,EAAE,6DAA6D;yBAC3E;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACzB,WAAW,EAAE,iEAAiE;yBAC/E;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,yCAAyC;4BACtD,OAAO,EAAE,IAAI;yBACd;wBACD,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yDAAyD;yBACvE;wBACD,iBAAiB,EAAE;4BACjB,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0CAA0C;yBACxD;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACzB,WAAW,EAAE,yBAAyB;yBACvC;wBACD,YAAY,EAAE;4BACZ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yCAAyC;yBACvD;wBACD,YAAY,EAAE;4BACZ,IAAI,EAAE,SAAS;4BACf,WAAW,EAAE,sCAAsC;4BACnD,OAAO,EAAE,KAAK;yBACf;qBACF;oBACD,QAAQ,EAAE,EAAE;iBACb;aACF;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,WAAW,EACT,sHAAsH;gBACxH,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,UAAU,CAAC;oBACtB,UAAU,EAAE;wBACV,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,mCAAmC;yBACjD;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;yBAC1B;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;yBAC1B;qBACF;iBACF;aACF;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,WAAW,EACT,+FAA+F;gBACjG,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,KAAK,EAAE;4BACL,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC;4BAC7E,WAAW,EAAE,8BAA8B;yBAC5C;qBACF;iBACF;aACF;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,6FAA6F;gBAC/F,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,UAAU,EAAE;wBACV,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,sCAAsC;yBACpD;qBACF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAWzB,CAAC;YAEF,MAAM,IAAI,GAAgB;gBACxB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;YAChC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;gBACnF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACnD,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC;YACrC,CAAC;YAED,IAAI,UAA8B,CAAC;YACnC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;gBAC1D,UAAU,GAAG,MAAM,mBAAmB,CACpC,QAAQ,EACR,MAAM,CAAC,UAAU,IAAI,GAAG,MAAM,CAAC,OAAO,cAAc,CACrD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO;gBACnC,CAAC,CAAC,qDAAqD,MAAM,CAAC,OAAO,CAAC,OAAO,iCAAiC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,IAAI;gBAC7O,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,WAAW,GAAG,eAAe;iBAChC,KAAK,EAAE;iBACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;iBACnE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY;gBAC3B,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACnD,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,IAAI,GAAG;gBACX,OAAO;gBACP,EAAE;gBACF,UAAU,CAAC,CAAC,CAAC,2BAA2B,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3D,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE;gBAC1E,EAAE;gBACF,iBAAiB;gBACjB,EAAE;gBACF,WAAW;qBACR,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACzH;qBACA,IAAI,CAAC,IAAI,CAAC;gBACb,eAAe,CAAC,MAAM,GAAG,EAAE;oBACzB,CAAC,CAAC,cAAc,eAAe,CAAC,MAAM,GAAG,EAAE,0BAA0B;oBACrE,CAAC,CAAC,EAAE;gBACN,OAAO,CAAC,MAAM,GAAG,CAAC;oBAChB,CAAC,CAAC,2BAA2B,OAAO,CAAC,MAAM,OAAO;wBAChD,OAAO;6BACJ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,GAAI,CAAC,WAAW,IAAI,CAAC;6BACtF,IAAI,CAAC,IAAI,CAAC;oBACf,CAAC,CAAC,EAAE;gBACN,OAAO,CAAC,MAAM,GAAG,CAAC;oBAChB,CAAC,CAAC,iFAAiF;oBACnF,CAAC,CAAC,EAAE;aACP;iBACE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAIzB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,sBAAsB,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAChE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACxE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAEnE,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,WAAW,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACzC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACnE,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG;gBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC3D,QAAQ;gBACR,MAAM;gBACN,KAAK;aACN,CAAC;YAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACnB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;gBACjB,CAAC;YACK,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM;gBAC/B,CAAC,CAAC,QAAQ;qBACL,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;qBACnE,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAChJ;qBACA,IAAI,CAAC,IAAI,CAAC;gBACf,CAAC,CAAC,sDAAsD,CAAC;YAE3D,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,QAAQ,sBAAsB,UAAU,CAAC,MAAM,eAAe,QAAQ,CAAC,MAAM,OAAO,SAAS,EAAE;qBACzK;iBACF;gBACD,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAsB,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;gBACxB,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;gBACvD,CAAC,CAAC,WAAW,EAAE,CAAC;YAElB,MAAM,IAAI,GAAG,KAAK;iBACf,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtH;iBACA,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,wCAAwC,KAAK,CAAC,MAAM,OAAO,IAAI,EAAE;qBACxE;iBACF;gBACD,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;YAClD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,WAAW,CAAC,mBAAmB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,IAAI,GAAG;gBACX,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,KAAK,EAAE;gBAC/B,EAAE;gBACF,gBAAgB,IAAI,CAAC,KAAK,EAAE;gBAC5B,mBAAmB,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;gBACxC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC9C,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC/C,EAAE;gBACF,gBAAgB;gBAChB,EAAE;gBACF,IAAI,CAAC,WAAW;gBAChB,EAAE;gBACF,oBAAoB;gBACpB,EAAE;gBACF,IAAI,CAAC,MAAM;gBACX,EAAE;gBACF,gBAAgB;gBAChB,EAAE;gBACF,IAAI,CAAC,WAAW;gBAChB,EAAE;gBACF,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBACxB,CAAC,CAAC,oBAAoB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACvE,CAAC,CAAC,EAAE;aACP;iBACE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED;YACE,OAAO,WAAW,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,MAAgO;IACrP,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpE,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,OAAO,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC/D,CAAC"}
@@ -0,0 +1,92 @@
1
+ export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
2
+ export type Layer = 'frontend' | 'backend' | 'network' | 'database' | 'cicd' | 'observability';
3
+ export type Language = 'javascript' | 'typescript' | 'python' | 'java' | 'kotlin' | 'go' | 'rust' | 'ruby' | 'php' | 'json' | 'yaml' | 'toml' | 'dockerfile' | 'unknown';
4
+ export interface MatchContext {
5
+ readonly snippet: string;
6
+ readonly line: number;
7
+ readonly column: number;
8
+ }
9
+ export interface FixPatch {
10
+ readonly find: string;
11
+ readonly replace: string;
12
+ readonly description: string;
13
+ }
14
+ export interface Finding {
15
+ readonly id: string;
16
+ readonly ruleId: string;
17
+ readonly title: string;
18
+ readonly layer: Layer;
19
+ readonly severity: Severity;
20
+ readonly file: string;
21
+ readonly match: MatchContext;
22
+ readonly description: string;
23
+ readonly impact: string;
24
+ readonly remediation: string;
25
+ readonly references: readonly string[];
26
+ readonly cwe?: string;
27
+ readonly owasp?: string;
28
+ readonly fix?: FixPatch;
29
+ }
30
+ export type RuleCheck = (context: RuleContext) => readonly Finding[];
31
+ export interface RuleContext {
32
+ readonly filePath: string;
33
+ readonly relativePath: string;
34
+ readonly language: Language;
35
+ readonly source: string;
36
+ readonly lines: readonly string[];
37
+ }
38
+ export interface Rule {
39
+ readonly id: string;
40
+ readonly title: string;
41
+ readonly layer: Layer;
42
+ readonly severity: Severity;
43
+ readonly description: string;
44
+ readonly threat: string;
45
+ readonly remediation: string;
46
+ readonly references: readonly string[];
47
+ readonly cwe?: string;
48
+ readonly owasp?: string;
49
+ readonly languages: readonly Language[];
50
+ readonly check: RuleCheck;
51
+ }
52
+ export interface ScanOptions {
53
+ readonly rootDir?: string;
54
+ readonly layers?: readonly Layer[];
55
+ readonly languages?: readonly Language[];
56
+ readonly dryRun?: boolean;
57
+ readonly reportPath?: string;
58
+ readonly maxMatchesPerFile?: number;
59
+ readonly ignore?: readonly string[];
60
+ readonly ruleIds?: readonly string[];
61
+ }
62
+ export interface ScanResult {
63
+ readonly rootDir: string;
64
+ readonly startedAt: string;
65
+ readonly finishedAt: string;
66
+ readonly durationMs: number;
67
+ readonly filesScanned: number;
68
+ readonly rulesEvaluated: number;
69
+ readonly findings: readonly Finding[];
70
+ readonly summary: ScanSummary;
71
+ readonly reportPath?: string;
72
+ readonly profile?: ProjectProfile;
73
+ }
74
+ export interface ProjectProfile {
75
+ readonly primary: Language;
76
+ readonly detected: readonly Language[];
77
+ readonly fileCounts: Readonly<Record<Language, number>>;
78
+ readonly applicableRules: readonly string[];
79
+ readonly frameworks?: readonly FrameworkDetection[];
80
+ }
81
+ export type Framework = 'react' | 'nextjs' | 'vue' | 'angular' | 'svelte' | 'express' | 'fastify' | 'nestjs' | 'django' | 'flask' | 'fastapi' | 'rails' | 'sinatra' | 'laravel' | 'symfony' | 'wordpress' | 'spring' | 'dotnet' | 'aspnet' | 'blazor' | 'cpp' | 'cmake' | 'cplusplus' | 'actix' | 'axum' | 'gin' | 'fiber';
82
+ export interface FrameworkDetection {
83
+ readonly name: Framework;
84
+ readonly category: 'frontend' | 'backend' | 'fullstack' | 'build';
85
+ readonly version?: string;
86
+ readonly evidence: readonly string[];
87
+ }
88
+ export interface ScanSummary {
89
+ readonly totalFindings: number;
90
+ readonly bySeverity: Record<Severity, number>;
91
+ readonly byLayer: Record<Layer, number>;
92
+ }
package/dist/types.js ADDED
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}