@maestro-ai/mcp-server 1.0.0

package/dist/analyzers/quality-analyzer.js

@@ -0,0 +1,196 @@
+/**
+ * Quality Analyzer - Code quality metrics and issues
+ */
+import { BaseAnalyzer } from "./base.js";
+import { parseCode } from "../utils/code-parser.js";
+const QUALITY_RULES = [
+    {
+        id: "QUAL-LONG-FUNCTION",
+        name: "Função muito longa",
+        description: "Funções com mais de 50 linhas são difíceis de manter",
+        severity: "medium",
+        pattern: /function\s+\w+|=>\s*\{/,
+        suggestion: "Extraia lógica para funções menores e mais específicas",
+    },
+    {
+        id: "QUAL-MAGIC-NUMBER",
+        name: "Número mágico",
+        description: "Número literal sem explicação do significado",
+        severity: "low",
+        pattern: /(?<![.\d])\b(?!0|1|2|10|100|1000\b)[3-9]\d*\b(?!\.\d)/,
+        suggestion: "Use constantes nomeadas para valores mágicos",
+    },
+    {
+        id: "QUAL-NESTED-CALLBACKS",
+        name: "Callback hell",
+        description: "Callbacks aninhados demais (mais de 3 níveis)",
+        severity: "medium",
+        pattern: /\)\s*=>\s*\{[^}]*\)\s*=>\s*\{[^}]*\)\s*=>\s*\{/,
+        suggestion: "Use async/await ou Promise.all para simplificar",
+    },
+    {
+        id: "QUAL-EMPTY-CATCH",
+        name: "Catch vazio",
+        description: "Catch que ignora o erro silenciosamente",
+        severity: "high",
+        pattern: /catch\s*\([^)]*\)\s*\{\s*\}/,
+        suggestion: "Trate ou logue o erro, nunca ignore silenciosamente",
+    },
+    {
+        id: "QUAL-TODO",
+        name: "TODO pendente",
+        description: "Código marcado como TODO não implementado",
+        severity: "info",
+        pattern: /\/\/\s*TODO|\/\*\s*TODO/i,
+        suggestion: "Resolva TODOs antes de mergear para main",
+    },
+    {
+        id: "QUAL-FIXME",
+        name: "FIXME pendente",
+        description: "Bug conhecido não corrigido",
+        severity: "medium",
+        pattern: /\/\/\s*FIXME|\/\*\s*FIXME/i,
+        suggestion: "Corrija FIXMEs antes de mergear para main",
+    },
+    {
+        id: "QUAL-ANY-TYPE",
+        name: "Uso de any",
+        description: "Tipo any desabilita verificação de tipos",
+        severity: "low",
+        pattern: /:\s*any\b|\bas\s+any\b/,
+        suggestion: "Use tipos específicos ou unknown se necessário",
+    },
+    {
+        id: "QUAL-CONSOLE",
+        name: "Console em código",
+        description: "Console.log deixado no código",
+        severity: "info",
+        pattern: /console\.(log|debug|trace)\s*\(/,
+        suggestion: "Use logger apropriado ou remova antes de deploy",
+    },
+    {
+        id: "QUAL-COMMENTED-CODE",
+        name: "Código comentado",
+        description: "Código comentado polui o codebase",
+        severity: "low",
+        pattern: /\/\/\s*(const|let|var|function|if|for|while|return)\s/,
+        suggestion: "Remova código comentado, use Git para histórico",
+    },
+    {
+        id: "QUAL-LARGE-FILE",
+        name: "Arquivo muito grande",
+        description: "Arquivos com mais de 500 linhas são difíceis de navegar",
+        severity: "medium",
+        pattern: /./,
+        suggestion: "Divida em módulos menores e mais focados",
+    },
+    {
+        id: "QUAL-DEEP-NESTING",
+        name: "Aninhamento profundo",
+        description: "Código com mais de 4 níveis de indentação",
+        severity: "medium",
+        pattern: /^\s{16,}\S/,
+        suggestion: "Use early returns e extraia funções auxiliares",
+    },
+    {
+        id: "QUAL-DUPLICATE-STRING",
+        name: "String duplicada",
+        description: "Mesma string literal usada múltiplas vezes",
+        severity: "low",
+        pattern: /['"][^'"]{10,}['"]/,
+        suggestion: "Extraia para constante ou arquivo de configuração",
+    },
+];
+export class QualityAnalyzer extends BaseAnalyzer {
+    category = "quality";
+    name = "Quality Analyzer";
+    description = "Analisa qualidade do código, complexidade e padrões";
+    async performAnalysis(content, options) {
+        const lines = content.split("\n");
+        const parsed = parseCode(content, options?.fileName || "file.ts");
+        // Check file size
+        if (lines.length > 500) {
+            this.addFinding({
+                severity: "medium",
+                title: "[QUAL-LARGE-FILE] Arquivo muito grande",
+                description: `Arquivo com ${lines.length} linhas (máximo recomendado: 500)`,
+                file: options?.fileName,
+                suggestion: "Divida em módulos menores e mais focados",
+            });
+        }
+        // Check complexity
+        if (parsed.complexity > 20) {
+            this.addFinding({
+                severity: "high",
+                title: "[QUAL-HIGH-COMPLEXITY] Alta complexidade ciclomática",
+                description: `Complexidade ${parsed.complexity} (máximo recomendado: 20)`,
+                file: options?.fileName,
+                suggestion: "Simplifique condicionais e extraia funções",
+            });
+        }
+        else if (parsed.complexity > 10) {
+            this.addFinding({
+                severity: "medium",
+                title: "[QUAL-MEDIUM-COMPLEXITY] Complexidade moderada",
+                description: `Complexidade ${parsed.complexity} (ideal: < 10)`,
+                file: options?.fileName,
+                suggestion: "Considere simplificar a lógica",
+            });
+        }
+        // Check for patterns in each line
+        const stringCounts = new Map();
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const lineNum = i + 1;
+            // Count string occurrences for duplication check
+            const strings = line.match(/['"][^'"]{10,}['"]/g) || [];
+            for (const str of strings) {
+                stringCounts.set(str, (stringCounts.get(str) || 0) + 1);
+            }
+            // Check each rule
+            for (const rule of QUALITY_RULES) {
+                if (rule.id === "QUAL-LARGE-FILE")
+                    continue;
+                if (rule.id === "QUAL-DUPLICATE-STRING")
+                    continue;
+                if (rule.pattern.test(line)) {
+                    this.addFinding({
+                        severity: rule.severity,
+                        title: `[${rule.id}] ${rule.name}`,
+                        description: rule.description,
+                        file: options?.fileName,
+                        line: lineNum,
+                        code: line.trim(),
+                        suggestion: rule.suggestion,
+                    });
+                }
+            }
+        }
+        // Report duplicate strings
+        for (const [str, count] of stringCounts) {
+            if (count >= 3) {
+                this.addFinding({
+                    severity: "low",
+                    title: "[QUAL-DUPLICATE-STRING] String duplicada",
+                    description: `String ${str.slice(0, 30)}... usada ${count} vezes`,
+                    file: options?.fileName,
+                    suggestion: "Extraia para constante ou arquivo de configuração",
+                });
+            }
+        }
+        // Check for functions without proper naming
+        for (const func of parsed.functions) {
+            if (func.name.length < 3) {
+                this.addFinding({
+                    severity: "low",
+                    title: "[QUAL-SHORT-NAME] Nome de função muito curto",
+                    description: `Função "${func.name}" deveria ter nome mais descritivo`,
+                    file: options?.fileName,
+                    line: func.line,
+                    suggestion: "Use nomes que descrevam o que a função faz",
+                });
+            }
+        }
+    }
+}
+//# sourceMappingURL=quality-analyzer.js.map

package/dist/analyzers/quality-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-analyzer.js","sourceRoot":"","sources":["../../src/analyzers/quality-analyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAuC,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAWpD,MAAM,aAAa,GAAkB;IACjC;QACI,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,wDAAwD;KACvE;IACD;QACI,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,uDAAuD;QAChE,UAAU,EAAE,8CAA8C;KAC7D;IACD;QACI,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,gDAAgD;QACzD,UAAU,EAAE,iDAAiD;KAChE;IACD;QACI,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,qDAAqD;KACpE;IACD;QACI,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0BAA0B;QACnC,UAAU,EAAE,0CAA0C;KACzD;IACD;QACI,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,6BAA6B;QAC1C,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4BAA4B;QACrC,UAAU,EAAE,2CAA2C;KAC1D;IACD;QACI,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,gDAAgD;KAC/D;IACD;QACI,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,+BAA+B;QAC5C,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,iDAAiD;KAChE;IACD;QACI,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,uDAAuD;QAChE,UAAU,EAAE,iDAAiD;KAChE;IACD;QACI,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,0CAA0C;KACzD;IACD;QACI,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,gDAAgD;KAC/D;IACD;QACI,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,mDAAmD;KAClE;CACJ,CAAC;AAEF,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC7C,QAAQ,GAAG,SAAkB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,WAAW,GAAG,qDAAqD,CAAC;IAE1D,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,OAAyB;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC;QAElE,kBAAkB;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,wCAAwC;gBAC/C,WAAW,EAAE,eAAe,KAAK,CAAC,MAAM,mCAAmC;gBAC3E,IAAI,EAAE,OAAO,EAAE,QAAQ;gBACvB,UAAU,EAAE,0CAA0C;aACzD,CAAC,CAAC;QACP,CAAC;QAED,mBAAmB;QACnB,IAAI,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,sDAAsD;gBAC7D,WAAW,EAAE,gBAAgB,MAAM,CAAC,UAAU,2BAA2B;gBACzE,IAAI,EAAE,OAAO,EAAE,QAAQ;gBACvB,UAAU,EAAE,4CAA4C;aAC3D,CAAC,CAAC;QACP,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,gDAAgD;gBACvD,WAAW,EAAE,gBAAgB,MAAM,CAAC,UAAU,gBAAgB;gBAC9D,IAAI,EAAE,OAAO,EAAE,QAAQ;gBACvB,UAAU,EAAE,gCAAgC;aAC/C,CAAC,CAAC;QACP,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,iDAAiD;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,kBAAkB;YAClB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,EAAE,KAAK,iBAAiB;oBAAE,SAAS;gBAC5C,IAAI,IAAI,CAAC,EAAE,KAAK,uBAAuB;oBAAE,SAAS;gBAElD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;wBAClC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,IAAI,EAAE,OAAO,EAAE,QAAQ;wBACvB,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;wBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC9B,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YACtC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC;oBACZ,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,0CAA0C;oBACjD,WAAW,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,KAAK,QAAQ;oBACjE,IAAI,EAAE,OAAO,EAAE,QAAQ;oBACvB,UAAU,EAAE,mDAAmD;iBAClE,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC;oBACZ,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,8CAA8C;oBACrD,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,oCAAoC;oBACrE,IAAI,EAAE,OAAO,EAAE,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,4CAA4C;iBAC3D,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/analyzers/security-analyzer.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security Analyzer - OWASP Top 10 and common vulnerabilities
+ */
+import { BaseAnalyzer, type AnalyzerOptions } from "./base.js";
+export declare class SecurityAnalyzer extends BaseAnalyzer {
+    category: "security";
+    name: string;
+    description: string;
+    protected performAnalysis(content: string, options?: AnalyzerOptions): Promise<void>;
+}
+//# sourceMappingURL=security-analyzer.d.ts.map

package/dist/analyzers/security-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-analyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/security-analyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAiB,MAAM,WAAW,CAAC;AAmK9E,qBAAa,gBAAiB,SAAQ,YAAY;IAC9C,QAAQ,EAAG,UAAU,CAAU;IAC/B,IAAI,SAAuB;IAC3B,WAAW,SAAuF;cAElF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;CAwB7F"}

package/dist/analyzers/security-analyzer.js

@@ -0,0 +1,177 @@
+/**
+ * Security Analyzer - OWASP Top 10 and common vulnerabilities
+ */
+import { BaseAnalyzer } from "./base.js";
+// OWASP Top 10 2021 rules
+const OWASP_RULES = [
+    // A01: Broken Access Control
+    {
+        id: "A01-ADMIN-BYPASS",
+        name: "Possível bypass de admin",
+        description: "Verificação de admin pode ser bypassada",
+        severity: "critical",
+        pattern: /isAdmin\s*[=!]=\s*(true|false|['"]true['"])/i,
+        suggestion: "Use verificação de roles no backend, não confie em flags do cliente",
+        references: ["https://owasp.org/Top10/A01_2021-Broken_Access_Control/"],
+    },
+    {
+        id: "A01-DIRECT-REF",
+        name: "Referência direta de objeto",
+        description: "ID de usuário/recurso exposto diretamente na URL ou parâmetro",
+        severity: "high",
+        pattern: /\/(user|users|admin|account)\/\{?(id|\d+)\}?/i,
+        suggestion: "Implemente verificação de autorização por recurso",
+        references: ["https://owasp.org/Top10/A01_2021-Broken_Access_Control/"],
+    },
+    // A02: Cryptographic Failures
+    {
+        id: "A02-HARDCODED-SECRET",
+        name: "Secret hardcoded",
+        description: "Chave, senha ou token hardcoded no código",
+        severity: "critical",
+        pattern: /(password|secret|api_key|apikey|token|jwt_secret|private_key)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+        suggestion: "Use variáveis de ambiente (process.env) para secrets",
+        references: ["https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"],
+    },
+    {
+        id: "A02-WEAK-CRYPTO",
+        name: "Algoritmo criptográfico fraco",
+        description: "Uso de MD5 ou SHA1 para hashing de senhas",
+        severity: "high",
+        pattern: /\.(md5|sha1)\s*\(/i,
+        suggestion: "Use bcrypt, argon2 ou PBKDF2 para senhas",
+        references: ["https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"],
+    },
+    {
+        id: "A02-HTTP",
+        name: "Comunicação não criptografada",
+        description: "URL usando HTTP ao invés de HTTPS",
+        severity: "medium",
+        pattern: /http:\/\/(?!localhost|127\.0\.0\.1)/i,
+        suggestion: "Use HTTPS para todas comunicações externas",
+        references: ["https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"],
+    },
+    // A03: Injection
+    {
+        id: "A03-SQL-INJECTION",
+        name: "SQL Injection",
+        description: "Query SQL construída por concatenação de strings",
+        severity: "critical",
+        pattern: /(?:query|execute|raw)\s*\(\s*[`'"].*\$\{|(?:SELECT|INSERT|UPDATE|DELETE).*\+\s*\w+/i,
+        suggestion: "Use prepared statements ou ORM com parâmetros",
+        references: ["https://owasp.org/Top10/A03_2021-Injection/"],
+    },
+    {
+        id: "A03-COMMAND-INJECTION",
+        name: "Command Injection",
+        description: "Execução de comando shell com input do usuário",
+        severity: "critical",
+        pattern: /(?:exec|spawn|execSync|spawnSync)\s*\([^)]*\$\{/i,
+        suggestion: "Evite exec com input do usuário, use libraries específicas",
+        references: ["https://owasp.org/Top10/A03_2021-Injection/"],
+    },
+    {
+        id: "A03-EVAL",
+        name: "Uso de eval",
+        description: "Uso de eval() que pode executar código arbitrário",
+        severity: "critical",
+        pattern: /\beval\s*\(/i,
+        suggestion: "Nunca use eval() com input do usuário. Use JSON.parse para dados",
+        references: ["https://owasp.org/Top10/A03_2021-Injection/"],
+    },
+    // A07: XSS
+    {
+        id: "A07-XSS-INNERHTML",
+        name: "XSS via innerHTML",
+        description: "Uso de innerHTML com dados não sanitizados",
+        severity: "high",
+        pattern: /\.innerHTML\s*=|dangerouslySetInnerHTML/i,
+        suggestion: "Use textContent ou sanitize HTML com DOMPurify",
+        references: ["https://owasp.org/Top10/A07_2021-Cross-Site_Scripting/"],
+    },
+    {
+        id: "A07-XSS-DOCUMENT-WRITE",
+        name: "XSS via document.write",
+        description: "Uso de document.write que pode injetar scripts",
+        severity: "high",
+        pattern: /document\.write\s*\(/i,
+        suggestion: "Use métodos DOM seguros como createElement",
+        references: ["https://owasp.org/Top10/A07_2021-Cross-Site_Scripting/"],
+    },
+];
+// Additional security rules
+const SECURITY_RULES = [
+    {
+        id: "SEC-CONSOLE-LOG",
+        name: "Console.log em produção",
+        description: "Console.log pode expor informações sensíveis",
+        severity: "low",
+        pattern: /console\.(log|debug|info)\s*\(/i,
+        suggestion: "Remova console.log ou use logger com níveis",
+        references: [],
+    },
+    {
+        id: "SEC-TODO-SECURITY",
+        name: "TODO de segurança pendente",
+        description: "Comentário indica problema de segurança não resolvido",
+        severity: "medium",
+        pattern: /\/\/.*TODO.*(?:security|segurança|auth|senha|password)/i,
+        suggestion: "Resolva TODOs de segurança antes do deploy",
+        references: [],
+    },
+    {
+        id: "SEC-CORS-STAR",
+        name: "CORS permissivo",
+        description: "CORS configurado para aceitar qualquer origem",
+        severity: "medium",
+        pattern: /cors\s*\(\s*\)|Access-Control-Allow-Origin.*\*/i,
+        suggestion: "Configure CORS para aceitar apenas origens conhecidas",
+        references: ["https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS"],
+    },
+    {
+        id: "SEC-JWT-NONE",
+        name: "JWT sem algoritmo",
+        description: "JWT pode aceitar algoritmo 'none'",
+        severity: "high",
+        pattern: /algorithms?\s*:\s*\[\s*['"]none['"]/i,
+        suggestion: "Especifique algoritmo explícito (RS256, HS256)",
+        references: ["https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/"],
+    },
+    {
+        id: "SEC-SENSITIVE-DATA",
+        name: "Dados sensíveis expostos",
+        description: "Variável com nome sensível pode ser exposta",
+        severity: "medium",
+        pattern: /(?:return|response|res\.json)\s*\(.*(?:password|ssn|credit_card|cpf)/i,
+        suggestion: "Nunca retorne dados sensíveis em responses",
+        references: [],
+    },
+];
+export class SecurityAnalyzer extends BaseAnalyzer {
+    category = "security";
+    name = "Security Analyzer";
+    description = "Analisa código em busca de vulnerabilidades OWASP Top 10 e problemas de segurança";
+    async performAnalysis(content, options) {
+        const lines = content.split("\n");
+        const allRules = [...OWASP_RULES, ...SECURITY_RULES];
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const lineNum = i + 1;
+            for (const rule of allRules) {
+                if (rule.pattern.test(line)) {
+                    this.addFinding({
+                        severity: rule.severity,
+                        title: `[${rule.id}] ${rule.name}`,
+                        description: rule.description,
+                        file: options?.fileName,
+                        line: lineNum,
+                        code: line.trim(),
+                        suggestion: rule.suggestion,
+                        references: rule.references,
+                    });
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=security-analyzer.js.map

package/dist/analyzers/security-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-analyzer.js","sourceRoot":"","sources":["../../src/analyzers/security-analyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAuC,MAAM,WAAW,CAAC;AAa9E,0BAA0B;AAC1B,MAAM,WAAW,GAAmB;IAChC,6BAA6B;IAC7B;QACI,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,8CAA8C;QACvD,UAAU,EAAE,qEAAqE;QACjF,UAAU,EAAE,CAAC,yDAAyD,CAAC;KAC1E;IACD;QACI,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+CAA+C;QACxD,UAAU,EAAE,mDAAmD;QAC/D,UAAU,EAAE,CAAC,yDAAyD,CAAC;KAC1E;IAED,8BAA8B;IAC9B;QACI,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,2FAA2F;QACpG,UAAU,EAAE,sDAAsD;QAClE,UAAU,EAAE,CAAC,0DAA0D,CAAC;KAC3E;IACD;QACI,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,2CAA2C;QACxD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,0CAA0C;QACtD,UAAU,EAAE,CAAC,0DAA0D,CAAC;KAC3E;IACD;QACI,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,sCAAsC;QAC/C,UAAU,EAAE,4CAA4C;QACxD,UAAU,EAAE,CAAC,0DAA0D,CAAC;KAC3E;IAED,iBAAiB;IACjB;QACI,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kDAAkD;QAC/D,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,qFAAqF;QAC9F,UAAU,EAAE,+CAA+C;QAC3D,UAAU,EAAE,CAAC,6CAA6C,CAAC;KAC9D;IACD;QACI,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,kDAAkD;QAC3D,UAAU,EAAE,4DAA4D;QACxE,UAAU,EAAE,CAAC,6CAA6C,CAAC;KAC9D;IACD;QACI,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,kEAAkE;QAC9E,UAAU,EAAE,CAAC,6CAA6C,CAAC;KAC9D;IAED,WAAW;IACX;QACI,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0CAA0C;QACnD,UAAU,EAAE,gDAAgD;QAC5D,UAAU,EAAE,CAAC,wDAAwD,CAAC;KACzE;IACD;QACI,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,uBAAuB;QAChC,UAAU,EAAE,4CAA4C;QACxD,UAAU,EAAE,CAAC,wDAAwD,CAAC;KACzE;CACJ,CAAC;AAEF,4BAA4B;AAC5B,MAAM,cAAc,GAAmB;IACnC;QACI,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,6CAA6C;QACzD,UAAU,EAAE,EAAE;KACjB;IACD;QACI,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yDAAyD;QAClE,UAAU,EAAE,4CAA4C;QACxD,UAAU,EAAE,EAAE;KACjB;IACD;QACI,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,iDAAiD;QAC1D,UAAU,EAAE,uDAAuD;QACnE,UAAU,EAAE,CAAC,wDAAwD,CAAC;KACzE;IACD;QACI,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,sCAAsC;QAC/C,UAAU,EAAE,gDAAgD;QAC5D,UAAU,EAAE,CAAC,8EAA8E,CAAC;KAC/F;IACD;QACI,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,uEAAuE;QAChF,UAAU,EAAE,4CAA4C;QACxD,UAAU,EAAE,EAAE;KACjB;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAC9C,QAAQ,GAAG,UAAmB,CAAC;IAC/B,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GAAG,mFAAmF,CAAC;IAExF,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,OAAyB;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC;QAErD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC;wBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;wBAClC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,IAAI,EAAE,OAAO,EAAE,QAAQ;wBACvB,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;wBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;qBAC9B,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/content/content/design-system/README.md

@@ -0,0 +1,231 @@
+# Design System Database
+
+Database extenso de design para uso pelos Especialistas MCP.
+
+## 📊 Recursos Disponíveis
+
+### Design Assets
+
+| Database | Registros | Arquivo | Descrição |
+|----------|-----------|---------|-----------|
+| **Colors** | 96 paletas | `data/colors.csv` | Paletas por tipo de produto |
+| **Typography** | 57 pares | `data/typography.csv` | Combinações de fontes Google Fonts |
+| **Styles** | 58 estilos | `data/styles.csv` | Estilos UI completos |
+| **Products** | - | `data/products.csv` | Recomendações por produto |
+| **Landing** | - | `data/landing.csv` | Padrões de landing page |
+| **UX Guidelines** | 99+ | `data/ux-guidelines.csv` | Best practices UX |
+| **UI Reasoning** | - | `data/ui-reasoning.csv` | Regras de design reasoning |
+| **Charts** | 25 tipos | `data/charts.csv` | Tipos de gráficos |
+| **Icons** | - | `data/icons.csv` | Diretrizes de ícones |
+| **Web Interface** | - | `data/web-interface.csv` | Guidelines web |
+| **React Performance** | - | `data/react-performance.csv` | Performance React |
+| **Prompts** | - | `data/prompts.csv` | Prompts para Stitch |
+
+### Stack Guidelines
+
+| Stack | Guidelines | Arquivo | Uso |
+|-------|------------|---------|-----|
+| **HTML + Tailwind** | 57 regras | `stacks/html-tailwind.csv` | HTML puro + Tailwind CSS |
+| **React** | 55 regras | `stacks/react.csv` | Aplicações React |
+| **Next.js** | 54 regras | `stacks/nextjs.csv` | Aplicações Next.js 14/15 |
+| **Vue** | ~50 regras | `stacks/vue.csv` | Aplicações Vue 3 |
+| **Svelte** | ~50 regras | `stacks/svelte.csv` | Aplicações Svelte 5 |
+| **React Native** | ~45 regras | `stacks/react-native.csv` | Apps mobile React Native |
+| **SwiftUI** | ~50 regras | `stacks/swiftui.csv` | Apps iOS/macOS nativas |
+| **Flutter** | ~47 regras | `stacks/flutter.csv` | Apps Flutter cross-platform |
+| **Jetpack Compose** | ~40 regras | `stacks/jetpack-compose.csv` | Apps Android nativas |
+| **shadcn/ui** | ~65 regras | `stacks/shadcn.csv` | shadcn/ui components |
+| **Nuxt.js** | ~70 regras | `stacks/nuxtjs.csv` | Aplicações Nuxt 3 |
+| **Nuxt UI** | ~60 regras | `stacks/nuxt-ui.csv` | Nuxt UI components |
+
+**Total:** ~600 guidelines estruturadas
+
+## 🗂️ Estrutura
+
+```
+design-system/
+├── README.md (este arquivo)
+├── data/           # CSVs design (cores, fontes, estilos)
+├── stacks/         # CSVs guidelines por stack/framework
+└── indexes/        # Índices Markdown navegáveis
+```
+
+## 🔍 Como Usar
+
+### Método 1: Consultar Índices
+
+Índices organizados para navegação rápida:
+
+- **[Cores](indexes/colors-index.md)** - 96 paletas por tipo de produto
+- **[Busca Rápida](indexes/quick-search.md)** - Atalhos e workflows
+- **[Stacks](indexes/stacks-index.md)** - Guidelines por framework ⭐
+
+### Método 2: Ler CSV Diretamente
+
+Para busca mais específica:
+
+```markdown
+# Design Assets
+content/design-system/data/colors.csv
+content/design-system/data/typography.csv
+
+# Stack Guidelines
+content/design-system/stacks/react.csv
+content/design-system/stacks/nextjs.csv
+```
+
+## 🎯 Casos de Uso
+
+### Para Especialista em UX Design
+
+**Durante Fase 3 (UX Design):**
+
+1. Consultar `indexes/colors-index.md` por tipo de produto
+2. Buscar em `data/colors.csv` por keywords
+3. Apresentar 2-3 opções ao usuário
+4. Validar Purple Ban
+5. Incorporar no Design Doc
+
+**Exemplo:**
+```markdown
+Usuário: "SaaS de gestão, moderno"
+→ colors.csv linha 2: SaaS General (#2563EB)
+→ typography.csv linha 2: Poppins + Open Sans
+→ Confirmar com usuário → Incorporar
+```
+
+### Para Especialista em Desenvolvimento Frontend
+
+**Durante Fase 11-12 (Implementação):**
+
+1. Consultar `indexes/stacks-index.md`
+2. Abrir CSV da stack (react.csv, nextjs.csv, etc)
+3. Filtrar por Severity: High (aplicar primeiro)
+4. Buscar por Category (State, Effects, Performance)
+5. Usar Code Good como exemplo
+6. Evitar Code Bad (anti-patterns)
+
+**Exemplo:**
+```markdown
+Stack: Next.js 15
+→ stacks/nextjs.csv
+→ Severity: High
+→ Guideline: "Configure caching explicitly (fetch uncached por padrão!)"
+→ Code Good: fetch(url, { cache: 'force-cache' })
+```
+
+### Para Especialista em Desenvolvimento Mobile
+
+**Durante Fase 11-12 (Mobile):**
+
+1. Identificar plataforma:
+   - iOS → `stacks/swiftui.csv`
+   - Android → `stacks/jetpack-compose.csv`
+   - Cross → `stacks/react-native.csv` ou `stacks/flutter.csv`
+
+2. Aplicar guidelines específicas da plataforma
+
+## 📖 Estrutura dos CSVs
+
+### Design Assets (colors, typography, styles)
+
+```csv
+No,Product Type,Keywords,Primary,Secondary,CTA,Background,Text,Border,Notes
+```
+
+### Stack Guidelines
+
+```csv
+No,Category,Guideline,Description,Do,Don't,Code Good,Code Bad,Severity,Docs URL
+```
+
+**Campos importantes:**
+- **Category** - State, Effects, Performance, etc
+- **Do/Don't** - Boas práticas vs anti-patterns
+- **Code Good/Bad** - Exemplos comparativos
+- **Severity** - High, Medium, Low
+- **Docs URL** - Link documentação oficial
+
+## ⚠️ Regras e Validações
+
+### Purple Ban (UX Design)
+
+Evitar roxo/violeta como cor principal:
+```markdown
+Cores proibidas: #6B21A8, #7C3AED, #8B5CF6, #A78BFA
+Validar após busca no database
+Alertar usuário se encontrar
+```
+
+### Validação com Usuário
+
+Database é **sugestão**, não imposição:
+1. Apresentar 2-3 opções
+2. Aguardar confirmação explícita
+3. Permitir ajustes manuais
+
+### Severidade (Stack Guidelines)
+
+**High Severity:**
+- Crítico
+- Aplicar PRIMEIRO
+- Evitar bugs graves
+
+**Medium:**
+- Importante
+- Boas práticas padrão
+
+**Low:**
+- Recomendações
+- Otimizações menores
+
+## 📚 Índices Disponíveis
+
+- **[colors-index.md](indexes/colors-index.md)** - Paletas por tipo de produto
+- **[quick-search.md](indexes/quick-search.md)** - Guia rápido de busca
+- **[stacks-index.md](indexes/stacks-index.md)** - Guidelines por framework ⭐
+
+## 🔗 Uso pelos Especialistas
+
+### Especialista em UX Design
+
+1. Perguntas de estilo ao usuário
+2. Buscar no database (colors, typography, styles)
+3. Apresentar opções
+4. Validar Purple Ban
+5. Incorporar no Design Doc
+
+### Especialista em Prototipagem Stitch
+
+1. Ler Design Doc (`docs/03-ux/design-doc.md`)
+2. Extrair cores/fontes
+3. Se incompleto, buscar no database
+4. Gerar prompts enriquecidos para Stitch
+
+### Especialista em Desenvolvimento Frontend
+
+1. Identificar stack do projeto
+2. Consultar `stacks/[stack].csv`
+3. Aplicar guidelines High Severity
+4. Seguir Do, evitar Don't
+5. Usar Code Good como referência
+
+### Especialista em Desenvolvimento Mobile
+
+1. Identificar plataforma (iOS/Android/Cross)
+2. Consultar stack correspondente
+3. Aplicar best practices específicas
+4. Validar contra guidelines
+
+## 📌 Notas
+
+- **Localização anterior:** `.agent/.shared/ui-ux-pro-max/data/`
+- **Migração:** 2026-01-23
+- **Formato:** CSVs + índices MD
+- **Manutenção:** Atualizar CSV → re-gerar índices
+
+---
+
+**Versão:** 2.0.0  
+**Última atualização:** 2026-01-23  
+**Resources:** 12 design CSVs + 12 stack CSVs + 3 índices