@mcp-guardian/server 1.0.0 → 1.2.0

package/dist/utils/payload-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-normalizer.js","sourceRoot":"","sources":["../../src/utils/payload-normalizer.ts"],"names":[],"mappings":"AAqBA;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAS;IACjB,SAAS,CAAS;IAEnC,YAAY,QAAQ,GAAG,CAAC,EAAE,SAAS,GAAG,SAAS;QAC7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAa;QACrB,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,0DAA0D;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;QAED,oEAAoE;QACpE,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,OAAO,GAAG,iBAAiB,CAAC;QAC9B,CAAC;QAED,gEAAgE;QAChE,OAAO,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC;YAEvB,wDAAwD;YACxD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAElC,uCAAuC;YACvC,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAEzC,6CAA6C;YAC7C,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAE7C,wCAAwC;YACxC,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE3C,oCAAoC;YACpC,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,OAAO,KAAK,MAAM;gBAAE,MAAM;YAC9B,KAAK,EAAE,CAAC;QACV,CAAC;QAED,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QAED,oCAAoC;QACpC,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;YAChC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxC,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;QAED,yDAAyD;QACzD,MAAM,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,oBAAoB,KAAK,OAAO,EAAE,CAAC;YACrC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,OAAO,GAAG,oBAAoB,CAAC;QACjC,CAAC;QAED,OAAO;YACL,UAAU,EAAE,OAAO;YACnB,WAAW,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;YACvC,eAAe;YACf,QAAQ,EAAE,KAAK;SAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;gBACzD,IAAI,CAAC;oBACH,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAa;QACpC,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,6CAA6C;YAC7C,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAa;QACxC,OAAO,KAAK;aACT,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;aACD,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/B,IAAI,IAAI,GAAG,QAAQ;oBAAE,OAAO,MAAM,CAAC,CAAC,kBAAkB;gBACtD,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,aAAa,GAAmC,IAAI,CAAC;IAE5D,MAAM,CAAC,gBAAgB;QAC7B,IAAI,iBAAiB,CAAC,aAAa;YAAE,OAAO,iBAAiB,CAAC,aAAa,CAAC;QAE5E,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB;QACpD,MAAM,KAAK,GAA4B;YACrC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC;YAChB,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC;YAChB,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;YACf,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC;YACjB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC;YACjB,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC;YACnB,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC;YACnB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;YACpB,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;YACpB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC;YAClB,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;YACpB,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC;SACrB,CAAC;QAEF,iBAAiB,CAAC,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,OAAO,iBAAiB,CAAC,aAAa,CAAC;IACzC,CAAC;IAEO,kBAAkB,CAAC,KAAa;QACtC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,iBAAiB;QACjB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC/D,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,kCAAkC;QAClC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,+BAA+B;QAC/B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,KAAa;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC9C,8DAA8D;YAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,uCAAuC;QACvC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAE9C,4CAA4C;QAC5C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAE5C,+CAA+C;QAC/C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;QAEhE,qEAAqE;QACrE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;QAC1C,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;QAEhD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;;AAGH,uDAAuD;AACvD,IAAI,eAAe,GAA6B,IAAI,CAAC;AAErD,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/utils/policy-auditor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Policy Audit Trail — records every policy change for compliance.
+ * Logs: who changed what, when, old/new values, and rollback info.
+ * Enable with: POLICY_AUDIT_ENABLED=true
+ */
+export interface PolicyChangeRecord {
+    timestamp: string;
+    actor: string;
+    change: string;
+    oldValue?: string;
+    newValue?: string;
+    sourceHash?: string;
+}
+export declare class PolicyAuditor {
+    private auditPath;
+    private enabled;
+    private lastHash;
+    constructor(auditPath?: string);
+    record(change: PolicyChangeRecord): void;
+    readAuditTrail(): PolicyChangeRecord[];
+    computeHash(content: string): string;
+    hasChanged(content: string): boolean;
+}
+//# sourceMappingURL=policy-auditor.d.ts.map

package/dist/utils/policy-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-auditor.d.ts","sourceRoot":"","sources":["../../src/utils/policy-auditor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,QAAQ,CAAuB;gBAE3B,SAAS,CAAC,EAAE,MAAM;IAK9B,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAWxC,cAAc,IAAI,kBAAkB,EAAE;IAUtC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAUpC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;CASrC"}

package/dist/utils/policy-auditor.js

@@ -0,0 +1,58 @@
+/**
+ * Policy Audit Trail — records every policy change for compliance.
+ * Logs: who changed what, when, old/new values, and rollback info.
+ * Enable with: POLICY_AUDIT_ENABLED=true
+ */
+import { writeFileSync, readFileSync, existsSync } from 'fs';
+import { Logger } from './logger.js';
+export class PolicyAuditor {
+    auditPath;
+    enabled;
+    lastHash = null;
+    constructor(auditPath) {
+        this.enabled = process.env['POLICY_AUDIT_ENABLED'] === 'true';
+        this.auditPath = auditPath || process.env['POLICY_AUDIT_LOG'] || './policy-audit.jsonl';
+    }
+    record(change) {
+        if (!this.enabled)
+            return;
+        try {
+            const line = JSON.stringify({ ...change, source: 'mcp-guardian-policy-auditor' }) + '\n';
+            writeFileSync(this.auditPath, line, { flag: 'a' });
+            Logger.debug(`[policy-auditor] Change recorded: ${change.change}`);
+        }
+        catch (err) {
+            Logger.error(`[policy-auditor] Failed to write audit log: ${err?.message}`);
+        }
+    }
+    readAuditTrail() {
+        if (!existsSync(this.auditPath))
+            return [];
+        try {
+            const content = readFileSync(this.auditPath, 'utf-8');
+            return content.trim().split('\n').filter(Boolean).map(l => JSON.parse(l));
+        }
+        catch {
+            return [];
+        }
+    }
+    computeHash(content) {
+        let hash = 0;
+        for (let i = 0; i < content.length; i++) {
+            const char = content.charCodeAt(i);
+            hash = ((hash << 5) - hash) + char;
+            hash |= 0;
+        }
+        return hash.toString(16);
+    }
+    hasChanged(content) {
+        const currentHash = this.computeHash(content);
+        if (this.lastHash && this.lastHash !== currentHash) {
+            this.lastHash = currentHash;
+            return true;
+        }
+        this.lastHash = currentHash;
+        return false;
+    }
+}
+//# sourceMappingURL=policy-auditor.js.map

package/dist/utils/policy-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-auditor.js","sourceRoot":"","sources":["../../src/utils/policy-auditor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAWrC,MAAM,OAAO,aAAa;IAChB,SAAS,CAAS;IAClB,OAAO,CAAU;IACjB,QAAQ,GAAkB,IAAI,CAAC;IAEvC,YAAY,SAAkB;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,MAAM,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,sBAAsB,CAAC;IAC1F,CAAC;IAED,MAAM,CAAC,MAA0B;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,GAAG,IAAI,CAAC;YACzF,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,+CAA+C,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACnC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/utils/tracing.d.ts

@@ -1,7 +1,7 @@
 /**
  * OpenTelemetry tracing for distributed request tracking across proxy + MCP servers.
- * Enable with: OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
- * Falls back gracefully if OpenTelemetry SDK is not installed.
+ * Enable with: OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
+ * Uses OTLP HTTP exporter (gRPC exporter deprecated due to critical CVE in protobufjs).
  */
 export declare function initTracing(): Promise<void>;
 //# sourceMappingURL=tracing.d.ts.map

package/dist/utils/tracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../src/utils/tracing.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CA2BjD"}
+{"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../../src/utils/tracing.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CA8BjD"}

package/dist/utils/tracing.js

@@ -1,8 +1,8 @@
 import { Logger } from './logger.js';
 /**
  * OpenTelemetry tracing for distributed request tracking across proxy + MCP servers.
- * Enable with: OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
- * Falls back gracefully if OpenTelemetry SDK is not installed.
+ * Enable with: OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
+ * Uses OTLP HTTP exporter (gRPC exporter deprecated due to critical CVE in protobufjs).
  */
 export async function initTracing() {
     if (!process.env['OTEL_EXPORTER_OTLP_ENDPOINT']) {
@@ -12,18 +12,20 @@ export async function initTracing() {
     try {
         const { NodeSDK } = await import('@opentelemetry/sdk-node');
         const { getNodeAutoInstrumentations } = await import('@opentelemetry/auto-instrumentations-node');
-        const { OTLPTraceExporter } = await import('@opentelemetry/exporter-otlp-grpc');
-        const exporter = new OTLPTraceExporter();
+        // Use OTLP HTTP exporter instead of deprecated gRPC
+        const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http');
+        const exporter = new OTLPTraceExporter({
+            url: `${process.env['OTEL_EXPORTER_OTLP_ENDPOINT']}/v1/traces`,
+        });
         const instruments = getNodeAutoInstrumentations({
             '@opentelemetry/instrumentation-http': { enabled: true },
-            '@opentelemetry/instrumentation-pino': { enabled: false },
         });
         const sdk = new NodeSDK({
             traceExporter: exporter,
             instrumentations: [instruments],
         });
         await sdk.start();
-        Logger.info('[tracing] OpenTelemetry tracing initialized — exporting to OTLP endpoint');
+        Logger.info('[tracing] OpenTelemetry tracing initialized — exporting to OTLP HTTP endpoint');
     }
     catch (err) {
         Logger.warn(`[tracing] OpenTelemetry initialization failed: ${err?.message}`);

package/dist/utils/tracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAClG,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAS,CAAC;QAChD,MAAM,WAAW,GAAG,2BAA2B,CAAC;YAC9C,qCAAqC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACxD,qCAAqC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;SAC1D,CAAQ,CAAC;QAEV,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;YACtB,aAAa,EAAE,QAAQ;YACvB,gBAAgB,EAAE,CAAC,WAAW,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kDAAkD,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/utils/tracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC5D,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAClG,oDAAoD;QACpD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QAEtF,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,YAAY;SAC/D,CAAQ,CAAC;QAEV,MAAM,WAAW,GAAG,2BAA2B,CAAC;YAC9C,qCAAqC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SACzD,CAAQ,CAAC;QAEV,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC;YACtB,aAAa,EAAE,QAAQ;YACvB,gBAAgB,EAAE,CAAC,WAAW,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kDAAkD,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@mcp-guardian/server",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Security, cost, and health audit for MCP infrastructure",
   "type": "module",
   "files": [
     "dist"
   ],
-  "main": "./dist/index.js",
   "bin": {
     "mcp-guardian": "./dist/cli.js"
   },
+  "main": "./dist/index.js",
   "engines": {
     "node": ">=18"
   },
@@ -40,7 +40,7 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.75.0",
-    "@opentelemetry/exporter-otlp-grpc": "^0.26.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
     "@opentelemetry/sdk-node": "^0.217.0",
     "axios": "^1.7.0",
     "chalk": "^5.3.0",