@mmerterden/multi-agent-toolkit-mcp 3.13.1 → 3.15.0

package/tools/ios-app-store-audit/context.js

@@ -17,7 +17,7 @@
  * deliberately non-compliant fixture.
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "./exec.js";
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { shq } from "./models.js";
 import { join, basename } from "path";
@@ -25,7 +25,7 @@ import { join, basename } from "path";
 /** Run a shell command, return trimmed stdout or empty string on failure. */
 function run(cmd) {
   try {
-    return execSync(cmd, { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }).trim();
+    return execBounded(cmd).trim();
   } catch {
     return "";
   }
@@ -233,7 +233,7 @@ export function extractEntitlements(executablePath) {
   }
   // Pipe XML into plutil for JSON conversion.
   try {
-    const json = execSync(`plutil -convert json -o - -`, {
+    const json = execBounded(`plutil -convert json -o - -`, {
       input: xml,
       encoding: "utf-8",
     }).trim();

package/tools/ios-app-store-audit/exec.js

@@ -0,0 +1,17 @@
+/**
+ * exec.js - the one way this audit runs a command.
+ *
+ * codesign --deep on a large bundle, strings over a multi-hundred-megabyte
+ * binary and plutil on a hostile plist can each run for a long time. execSync
+ * with no timeout blocks the server's event loop for as long as the child
+ * lives, so every command here gets a bound on both time and output.
+ */
+
+import { execSync } from "child_process";
+
+export const EXEC_TIMEOUT_MS = 120000;
+export const EXEC_MAX_BUFFER = 64 * 1024 * 1024;
+
+export function execBounded(cmd, opts = {}) {
+  return execSync(cmd, { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS, maxBuffer: EXEC_MAX_BUFFER, ...opts });
+}

package/tools/ios-app-store-audit/index.js

@@ -184,18 +184,3 @@ export async function runAudit({ archivePath, rules = "all", options = {} } = {}
     violations,
   };
 }
-
-// ---------- MCP tool descriptor (consumed by main index.js) ---------------
-
-export const TOOL_DESCRIPTOR = {
-  name: "ios_app_store_audit",
-  description: "Deep App Store Review compliance audit for .xcarchive bundles. 18-rule catalog covering privacy manifest, code signing, embedded SDKs, entitlements, asset hygiene, IPv6 compliance, debug-tool leak detection, Swift ABI compatibility, and more. Returns structured JSON with severity-ranked violations and ITMS error code mappings. Replaces the lighter ios_archive_audit (deprecated). Use --rules=core for the 6 baseline checks, --rules=deep|all for the full scan.",
-  inputSchema: {
-    type: "object",
-    properties: {
-      archive_path: { type: "string", description: "Absolute path to the .xcarchive bundle" },
-      rules: { type: "string", description: "'all' (default) | 'core' | 'deep' | comma-separated ruleIDs" },
-    },
-    required: ["archive_path"],
-  },
-};

package/tools/ios-app-store-audit/rules/code-signing.js

@@ -12,7 +12,7 @@
  *   5. Main executable passes `codesign --verify --deep --strict`
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync } from "fs";
 import { Severity, makeViolation, shq } from "../models.js";
 
@@ -22,7 +22,7 @@ export const description = "Checks entitlements, provisioning, and signing for A
 
 function isCodeSigned(executablePath) {
   try {
-    execSync(`/usr/bin/codesign --verify --deep --strict ${shq(executablePath)}`, {
+    execBounded(`/usr/bin/codesign --verify --deep --strict ${shq(executablePath)}`, {
       stdio: "ignore",
     });
     return true;

package/tools/ios-app-store-audit/rules/dead-reference.js

@@ -8,7 +8,7 @@
  * Severity is .warning (images) / .info (empty nibs); never .error.
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync, readdirSync, statSync } from "fs";
 import { join, extname, parse as parsePath } from "path";
 import { Severity, makeViolation, shq } from "../models.js";
@@ -29,7 +29,7 @@ const SYSTEM_PREFIXES = [
 /** Return all printable strings in a binary as a Set. */
 function binaryStrings(executablePath) {
   try {
-    const out = execSync(`/usr/bin/strings ${shq(executablePath)}`, {
+    const out = execBounded(`/usr/bin/strings ${shq(executablePath)}`, {
       encoding: "utf-8",
       maxBuffer: 256 * 1024 * 1024,
     });

package/tools/ios-app-store-audit/rules/debug-tool-leak.js

@@ -15,7 +15,7 @@
  *   5. Generic name-pattern catch-all
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync, readFileSync, statSync } from "fs";
 import { dirname, basename, join } from "path";
 import { fileURLToPath } from "url";
@@ -47,7 +47,7 @@ function runStringsGrep(executablePath, patterns) {
   if (patterns.length === 0) return "";
   const grepPattern = patterns.map(escapeForGrep).join("|");
   try {
-    return execSync(
+    return execBounded(
       `/usr/bin/strings ${shq(executablePath)} | grep -E '${grepPattern}' 2>/dev/null | head -200`,
       { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }
     );

package/tools/ios-app-store-audit/rules/embedded-sdk.js

@@ -8,7 +8,7 @@
  * Source list: https://developer.apple.com/support/third-party-SDK-requirements/
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync, readFileSync } from "fs";
 import { dirname, basename, join } from "path";
 import { fileURLToPath } from "url";
@@ -46,7 +46,7 @@ function isAppleRequiredSDK(frameworkName) {
 
 function isCodeSigned(path) {
   try {
-    execSync(`/usr/bin/codesign --verify --deep --strict ${shq(path)}`, { stdio: "ignore" });
+    execBounded(`/usr/bin/codesign --verify --deep --strict ${shq(path)}`, { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -57,7 +57,7 @@ function simulatorArchitectures(binaryPath) {
   if (!existsSync(binaryPath)) return [];
   let archs = "";
   try {
-    archs = execSync(`/usr/bin/lipo -archs ${shq(binaryPath)} 2>/dev/null`, {
+    archs = execBounded(`/usr/bin/lipo -archs ${shq(binaryPath)} 2>/dev/null`, {
       encoding: "utf-8",
     }).trim();
   } catch {

package/tools/ios-app-store-audit/rules/extension-signing.js

@@ -7,7 +7,7 @@
  * ITMS error codes: 90035, 90046, 90283. Apple Guideline 5.1.1.
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync } from "fs";
 import { join, basename } from "path";
 import { Severity, makeViolation, shq } from "../models.js";
@@ -19,7 +19,7 @@ export const description = "Checks embedded extensions for signing, bundle ID pr
 
 function isCodeSigned(path) {
   try {
-    execSync(`/usr/bin/codesign --verify --deep --strict ${shq(path)}`, { stdio: "ignore" });
+    execBounded(`/usr/bin/codesign --verify --deep --strict ${shq(path)}`, { stdio: "ignore" });
     return true;
   } catch {
     return false;

package/tools/ios-app-store-audit/rules/ipv6-compliance.js

@@ -8,7 +8,7 @@
  *   - Raw socket APIs that don't auto-handle IPv6
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync } from "fs";
 import { Severity, makeViolation, shq } from "../models.js";
 
@@ -44,7 +44,7 @@ export function check(ctx) {
 
   let stringsOutput = "";
   try {
-    stringsOutput = execSync(`/usr/bin/strings ${shq(ctx.executablePath)}`, {
+    stringsOutput = execBounded(`/usr/bin/strings ${shq(ctx.executablePath)}`, {
       encoding: "utf-8",
       maxBuffer: 256 * 1024 * 1024,
     });

package/tools/ios-app-store-audit/rules/production-hygiene.js

@@ -7,7 +7,7 @@
  * Apple Guidelines: 2.1 (App Completeness), 2.5.1 (Software Requirements).
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync, readdirSync, statSync } from "fs";
 import { join, basename, extname } from "path";
 import { Severity, makeViolation, shq } from "../models.js";
@@ -126,7 +126,7 @@ function checkLoggingSymbols(ctx) {
   const grepPattern = escapedPatterns.join("|");
   let output = "";
   try {
-    output = execSync(
+    output = execBounded(
       `/usr/bin/strings ${shq(ctx.executablePath)} | grep -E '${grepPattern}' 2>/dev/null | head -100`,
       { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024 }
     );

package/tools/ios-app-store-audit/rules/provisioning-profile.js

@@ -10,7 +10,7 @@
  * binary / XML plists across Xcode versions.
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync } from "fs";
 import { join } from "path";
 import { Severity, makeViolation, shq } from "../models.js";
@@ -24,13 +24,13 @@ const SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1000;
 function decodeProfile(profilePath) {
   try {
     // CMS decode → produces plist bytes on stdout (XML/binary depending on Xcode).
-    const cmsXml = execSync(`/usr/bin/security cms -D -i ${shq(profilePath)} 2>/dev/null`, {
+    const cmsXml = execBounded(`/usr/bin/security cms -D -i ${shq(profilePath)} 2>/dev/null`, {
       encoding: "utf-8",
       maxBuffer: 16 * 1024 * 1024,
     });
     if (!cmsXml.trim()) return null;
     // Convert to JSON for predictable typed access.
-    const json = execSync(`plutil -convert json -o - -`, {
+    const json = execBounded(`plutil -convert json -o - -`, {
       input: cmsXml,
       encoding: "utf-8",
     }).trim();

package/tools/ios-app-store-audit/rules/required-reason-api.js

@@ -8,7 +8,7 @@
  * is present, App Review rejects with ITMS-91065 / 91066 errors.
  */
 
-import { execSync } from "child_process";
+import { execBounded } from "../exec.js";
 import { existsSync } from "fs";
 import { Severity, makeViolation, shq } from "../models.js";
 
@@ -59,7 +59,7 @@ const CATEGORIES = [
 
 function binaryStringsBlob(executablePath) {
   try {
-    return execSync(`/usr/bin/strings ${shq(executablePath)}`, {
+    return execBounded(`/usr/bin/strings ${shq(executablePath)}`, {
       encoding: "utf-8",
       maxBuffer: 256 * 1024 * 1024,
     });

package/tools/offload/index.js

@@ -15,7 +15,7 @@
 // outputSchema answers with JSON the host parses as structuredContent, and
 // replacing that with a summary would break the parse.
 
-import { writeFileSync, readFileSync, mkdirSync, existsSync, readdirSync, statSync, rmSync } from "fs";
+import { writeFileSync, readFileSync, mkdirSync, existsSync, readdirSync, statSync, rmSync, chmodSync } from "fs";
 import { join, resolve, sep } from "path";
 import { homedir } from "os";
 
@@ -202,11 +202,15 @@ export function offloadLargeText(tool, text, opts = {}) {
   const stamp = opts.stamp ?? new Date().toISOString().replace(/[:.]/g, "-");
   if (text.length < minChars) return { text, offloaded: false };
 
+  // Owner-only. A payload is whatever the tool returned - a logcat with tokens
+  // in it, a keychain listing, a page's text - and the default umask would
+  // leave it readable by every account on the machine.
   let path;
   try {
-    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
     path = join(dir, `${tool}-${stamp}.txt`);
-    writeFileSync(path, text);
+    writeFileSync(path, text, { mode: 0o600 });
   } catch {
     // A write failure must not lose the payload: fall back to returning it
     // whole. Spending context is recoverable; dropping the tail is not.

package/tools/policy/egress-proxy.js

@@ -0,0 +1,268 @@
+// Strict-mode egress proxy for the headless browser.
+//
+// A browser-context route sees the first request of a redirect chain and never
+// the hops after it, so a page on an allowed host can answer 302 to a refused
+// one and the browser follows. Every hop does pass through a proxy, though, so
+// under the strict policy the browser is launched with this one: each plain
+// HTTP request, each CONNECT tunnel and each upgrade is checked against the
+// URL policy before a socket is opened, and the connection goes to the address
+// the check resolved, so a DNS answer cannot change between the two.
+//
+// It listens on 127.0.0.1 only, is unref'd so it never keeps the process
+// alive, and answers a refused request with 403 and the reason as the body.
+// An upstream that does not accept the connection within the connect timeout
+// (MCP_TOOLKIT_PROXY_CONNECT_TIMEOUT_MS, 15 s by default) is answered with 504.
+
+import { createServer, request as httpRequest } from "node:http";
+import { connect, isIP } from "node:net";
+import { pipeline } from "node:stream";
+import { lookup as dnsLookup } from "node:dns/promises";
+
+export const DEFAULT_CONNECT_TIMEOUT_MS = 15000;
+
+export function proxyConnectTimeoutMs(env = process.env, warn = (m) => process.stderr.write(m)) {
+  const raw = String(env.MCP_TOOLKIT_PROXY_CONNECT_TIMEOUT_MS ?? "").trim();
+  if (!raw) return DEFAULT_CONNECT_TIMEOUT_MS;
+  if (/^\d+$/.test(raw) && Number(raw) > 0) return Number(raw);
+  warn(`multi-agent-toolkit: ignoring MCP_TOOLKIT_PROXY_CONNECT_TIMEOUT_MS value "${raw}" (not a positive whole number of milliseconds), using ${DEFAULT_CONNECT_TIMEOUT_MS}\n`);
+  return DEFAULT_CONNECT_TIMEOUT_MS;
+}
+
+const HOP_BY_HOP = ["proxy-connection", "proxy-authorization", "proxy-authenticate", "keep-alive", "te", "trailer", "transfer-encoding", "upgrade"];
+
+// Runs the policy check through a lookup that remembers its answers, so the
+// connection can be pinned to exactly what was judged.
+async function judge(url, check, resolve) {
+  let answers = null;
+  const lookup = async (host, opts) => {
+    answers = await resolve(host, opts);
+    return answers;
+  };
+  const refused = await check(url, lookup);
+  return { refused, answers };
+}
+
+// A net/http `lookup` option that hands back the checked answers instead of
+// resolving again. Without answers (an IP literal, or a host the allow list
+// named) the ordinary resolver is used.
+function pinnedLookup(answers) {
+  if (!answers || !answers.length) return undefined;
+  return (hostname, options, callback) => {
+    const cb = typeof options === "function" ? options : callback;
+    const opts = typeof options === "function" ? {} : options || {};
+    if (opts.all) return cb(null, answers);
+    return cb(null, answers[0].address, answers[0].family);
+  };
+}
+
+function splitHostPort(authority, defaultPort) {
+  const m = /^\[([^\]]+)\]:(\d+)$/.exec(authority) || /^([^:]+):(\d+)$/.exec(authority);
+  if (m) return { host: m[1], port: Number(m[2]) };
+  return { host: authority.replace(/^\[|\]$/g, ""), port: defaultPort };
+}
+
+const validPort = (port) => Number.isInteger(port) && port >= 1 && port <= 65535;
+
+const hostForUrl = (host) => (isIP(host) === 6 ? `[${host}]` : host);
+
+const bare = (hostname) => hostname.replace(/^\[|\]$/g, "");
+
+const gone = (socket) => socket.destroyed || !socket.writable;
+
+// Each side of a tunnel is torn down when the other closes, so neither end is
+// left holding a descriptor for a peer that has gone.
+function splice(client, upstream) {
+  upstream.pipe(client);
+  client.pipe(upstream);
+  client.on("close", () => upstream.destroy());
+  upstream.on("close", () => client.destroy());
+}
+
+function rawReply(socket, status, body = "") {
+  if (gone(socket)) return;
+  const head = `HTTP/1.1 ${status}\r\ncontent-type: text/plain; charset=utf-8\r\ncontent-length: ${Buffer.byteLength(body)}\r\nconnection: close\r\n\r\n`;
+  socket.end(`${head}${body}`);
+}
+
+// Opens a TCP connection to the judged host through the pinned lookup. If it is
+// not established within `timeoutMs` the socket is destroyed and `onTimeout`
+// runs instead of `onOpen`.
+function dial({ host, port, answers, timeoutMs }, onOpen, onTimeout) {
+  let open = false;
+  const upstream = connect({ host, port, lookup: pinnedLookup(answers) }, () => {
+    open = true;
+    clearTimeout(timer);
+    onOpen();
+  });
+  const timer = setTimeout(() => {
+    if (open) return;
+    upstream.destroy();
+    onTimeout();
+  }, timeoutMs);
+  upstream.on("close", () => clearTimeout(timer));
+  return { upstream, isOpen: () => open };
+}
+
+/**
+ * Starts the proxy. `check(url, lookup)` resolves to null when the URL may be
+ * fetched and to the refusal reason otherwise; `onRefuse(url, reason)` hears
+ * about every refusal. `resolve` is the DNS lookup the check and the pinned
+ * connection share. `connectTimeoutMs` bounds how long an upstream connect may
+ * take. Resolves to { url, port, close }.
+ *
+ * Error handlers go on the client socket before anything is awaited: a client
+ * that resets while its request is being judged would otherwise raise an
+ * unhandled 'error' and take the process with it. Every handler is wrapped so
+ * no rejection escapes, and nothing is opened upstream for a client that has
+ * already gone.
+ */
+export async function startEgressProxy({ check, onRefuse = () => {}, resolve = dnsLookup, connectTimeoutMs = proxyConnectTimeoutMs() }) {
+  const refuse = (url, reason) => {
+    try { onRefuse(url, reason); } catch { /* reporting must not break the proxy */ }
+  };
+
+  const server = createServer(async (req, res) => {
+    req.on("error", () => {});
+    res.on("error", () => {});
+    try {
+      let target;
+      try {
+        target = new URL(req.url);
+      } catch {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("absolute URL required");
+        return;
+      }
+      const { refused, answers } = await judge(target.href, check, resolve);
+      if (res.destroyed || req.socket.destroyed) return;
+      if (refused) {
+        refuse(target.href, refused);
+        res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+        res.end(refused);
+        return;
+      }
+      const headers = { ...req.headers };
+      for (const h of HOP_BY_HOP) delete headers[h];
+      let connectTimedOut = false;
+      const upstream = httpRequest({
+        host: bare(target.hostname),
+        port: target.port || 80,
+        method: req.method,
+        path: `${target.pathname}${target.search}`,
+        headers,
+        lookup: pinnedLookup(answers),
+      }, (up) => {
+        res.writeHead(up.statusCode || 502, up.headers);
+        pipeline(up, res, (err) => { if (err) res.destroy(); });
+      });
+      const timer = setTimeout(() => {
+        connectTimedOut = true;
+        upstream.destroy(new Error("upstream connect timed out"));
+      }, connectTimeoutMs);
+      upstream.on("socket", (socket) => {
+        if (!socket.connecting) clearTimeout(timer);
+        else socket.once("connect", () => clearTimeout(timer));
+      });
+      upstream.on("close", () => clearTimeout(timer));
+      upstream.on("error", (e) => {
+        clearTimeout(timer);
+        if (res.destroyed) return;
+        if (res.headersSent) { res.destroy(); return; }
+        res.writeHead(connectTimedOut ? 504 : 502, { "content-type": "text/plain" });
+        res.end(connectTimedOut ? "upstream connect timed out" : `upstream error: ${e.code || e.message}`);
+      });
+      res.on("close", () => upstream.destroy());
+      req.pipe(upstream);
+    } catch (e) {
+      if (res.destroyed) return;
+      if (!res.headersSent) res.writeHead(502, { "content-type": "text/plain" });
+      res.end(`proxy error: ${e?.code || e?.message || e}`);
+    }
+  });
+
+  // HTTPS and WebSocket tunnels. Only the authority is visible here, which is
+  // all the policy judges.
+  server.on("connect", async (req, client, head) => {
+    client.on("error", () => client.destroy());
+    try {
+      const { host, port } = splitHostPort(req.url, 443);
+      if (!host || !validPort(port)) {
+        rawReply(client, "400 Bad Request", "invalid CONNECT authority");
+        return;
+      }
+      const url = `https://${hostForUrl(host)}:${port}/`;
+      let judged;
+      try {
+        judged = new URL(url);
+      } catch {
+        rawReply(client, "400 Bad Request", "invalid CONNECT authority");
+        return;
+      }
+      const { refused, answers } = await judge(url, check, resolve);
+      if (gone(client)) return;
+      if (refused) {
+        refuse(url, refused);
+        rawReply(client, "403 Forbidden", refused);
+        return;
+      }
+      const { upstream, isOpen } = dial({ host: bare(judged.hostname), port, answers, timeoutMs: connectTimeoutMs }, () => {
+        client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head && head.length) upstream.write(head);
+        splice(client, upstream);
+      }, () => rawReply(client, "504 Gateway Timeout", "upstream connect timed out"));
+      upstream.on("error", () => (isOpen() ? client.destroy() : rawReply(client, "502 Bad Gateway")));
+      client.on("close", () => upstream.destroy());
+    } catch (e) {
+      rawReply(client, "502 Bad Gateway", `proxy error: ${e?.code || e?.message || e}`);
+    }
+  });
+
+  // A plain ws:// request sent to the proxy as an absolute-URI upgrade.
+  server.on("upgrade", async (req, client, head) => {
+    client.on("error", () => client.destroy());
+    try {
+      let target;
+      try {
+        target = new URL(req.url);
+      } catch {
+        rawReply(client, "400 Bad Request");
+        return;
+      }
+      const httpUrl = target.href.replace(/^ws(s?):/i, "http$1:");
+      const { refused, answers } = await judge(httpUrl, check, resolve);
+      if (gone(client)) return;
+      if (refused) {
+        refuse(target.href, refused);
+        rawReply(client, "403 Forbidden");
+        return;
+      }
+      const { upstream, isOpen } = dial({ host: bare(target.hostname), port: Number(target.port) || 80, answers, timeoutMs: connectTimeoutMs }, () => {
+        const lines = [`${req.method} ${target.pathname}${target.search} HTTP/1.1`];
+        for (let i = 0; i < req.rawHeaders.length; i += 2) {
+          if (req.rawHeaders[i].toLowerCase() === "proxy-connection") continue;
+          lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+        }
+        upstream.write(`${lines.join("\r\n")}\r\n\r\n`);
+        if (head && head.length) upstream.write(head);
+        splice(client, upstream);
+      }, () => rawReply(client, "504 Gateway Timeout", "upstream connect timed out"));
+      upstream.on("error", () => (isOpen() ? client.destroy() : rawReply(client, "502 Bad Gateway")));
+      client.on("close", () => upstream.destroy());
+    } catch (e) {
+      rawReply(client, "502 Bad Gateway", `proxy error: ${e?.code || e?.message || e}`);
+    }
+  });
+
+  server.on("clientError", (_e, socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  server.unref();
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    port,
+    close: () => new Promise((resolve) => server.close(() => resolve())),
+  };
+}