@mxf-dev/core 1.0.0

package/dist/protocols/mcp/security/McpSecurityConfig.js

@@ -0,0 +1,306 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/mxf-dev/mxf
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * McpSecurityConfig.ts
+ *
+ * Configuration interface and loader for MCP security settings.
+ * Allows customization of security policies through configuration files.
+ */
+import { Logger } from '../../../utils/Logger.js';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+const logger = new Logger('info', 'McpSecurityConfig', 'server');
+/**
+ * Default security configuration
+ */
+export const DEFAULT_SECURITY_CONFIG = {
+    enabled: true,
+    mode: 'moderate',
+    commands: {
+        defaultTimeout: 30000,
+        maxCommandLength: 1000
+    },
+    filesystem: {
+        maxFileSize: 10 * 1024 * 1024, // 10MB
+        allowOutsideProject: false,
+        autoBackup: false
+    },
+    confirmation: {
+        strategy: 'interactive',
+        autoApproveInDev: false,
+        timeout: 30000,
+        requireConfirmationFor: ['high', 'critical']
+    },
+    logging: {
+        enabled: true,
+        includeOutput: false,
+        maxLogSize: 50 * 1024 * 1024 // 50MB
+    }
+};
+/**
+ * Load security configuration from file or environment
+ */
+export class McpSecurityConfigLoader {
+    config = DEFAULT_SECURITY_CONFIG;
+    configPath;
+    constructor(configPath) {
+        this.configPath = configPath;
+    }
+    /**
+     * Load configuration from file
+     */
+    async load() {
+        try {
+            // Find config file if not provided
+            if (!this.configPath) {
+                this.configPath = await this.findConfigFile();
+            }
+            // Try to load from config file
+            if (this.configPath) {
+                const configData = await fs.readFile(this.configPath, 'utf8');
+                const fileConfig = JSON.parse(configData);
+                this.config = this.mergeConfigs(DEFAULT_SECURITY_CONFIG, fileConfig);
+            }
+            // Apply environment variable overrides
+            this.applyEnvironmentOverrides();
+            // Apply platform-specific overrides
+            this.applyPlatformOverrides();
+            // Validate configuration
+            this.validateConfig();
+            return this.config;
+        }
+        catch (error) {
+            logger.warn(`Failed to load security config: ${error}. Using defaults.`);
+            return DEFAULT_SECURITY_CONFIG;
+        }
+    }
+    /**
+     * Save configuration to file
+     */
+    async save(config, configPath) {
+        const savePath = configPath || this.configPath || this.getDefaultConfigPath();
+        try {
+            // Ensure directory exists
+            await fs.mkdir(path.dirname(savePath), { recursive: true });
+            // Write config
+            await fs.writeFile(savePath, JSON.stringify(config, null, 2), 'utf8');
+        }
+        catch (error) {
+            logger.error(`Failed to save security config: ${error}`);
+            throw error;
+        }
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return this.config;
+    }
+    /**
+     * Find configuration file in standard locations
+     */
+    async findConfigFile() {
+        const locations = [
+            // Current directory
+            'mcp-security.json',
+            '.mcp-security.json',
+            // Config directory
+            'config/mcp-security.json',
+            '.config/mcp-security.json',
+            // Home directory
+            path.join(process.env.HOME || process.env.USERPROFILE || '', '.mcp-security.json')
+        ];
+        for (const location of locations) {
+            try {
+                const fullPath = path.resolve(location);
+                // Check if file exists
+                try {
+                    await fs.access(fullPath);
+                    return fullPath;
+                }
+                catch {
+                    // File doesn't exist, continue to next location
+                }
+            }
+            catch {
+                // Continue to next location
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Get default config path
+     */
+    getDefaultConfigPath() {
+        return path.join(process.cwd(), 'config', 'mcp-security.json');
+    }
+    /**
+     * Apply environment variable overrides
+     */
+    applyEnvironmentOverrides() {
+        // MCP_SECURITY_ENABLED
+        if (process.env.MCP_SECURITY_ENABLED !== undefined) {
+            this.config.enabled = process.env.MCP_SECURITY_ENABLED === 'true';
+        }
+        // MCP_SECURITY_MODE
+        if (process.env.MCP_SECURITY_MODE) {
+            this.config.mode = process.env.MCP_SECURITY_MODE;
+        }
+        // MCP_SECURITY_CONFIRMATION
+        if (process.env.MCP_SECURITY_CONFIRMATION) {
+            this.config.confirmation.strategy = process.env.MCP_SECURITY_CONFIRMATION;
+        }
+        // MCP_SECURITY_AUTO_APPROVE_DEV
+        if (process.env.MCP_SECURITY_AUTO_APPROVE_DEV !== undefined) {
+            this.config.confirmation.autoApproveInDev =
+                process.env.MCP_SECURITY_AUTO_APPROVE_DEV === 'true';
+        }
+        // MCP_SECURITY_LOG_PATH
+        if (process.env.MCP_SECURITY_LOG_PATH) {
+            this.config.logging.logPath = process.env.MCP_SECURITY_LOG_PATH;
+        }
+    }
+    /**
+     * Apply platform-specific overrides
+     */
+    applyPlatformOverrides() {
+        const platform = process.platform;
+        const overrides = this.config.platformOverrides?.[platform];
+        if (overrides) {
+            this.config = this.mergeConfigs(this.config, overrides);
+        }
+    }
+    /**
+     * Merge configurations
+     */
+    mergeConfigs(base, override) {
+        return {
+            ...base,
+            ...override,
+            commands: {
+                ...base.commands,
+                ...override.commands
+            },
+            filesystem: {
+                ...base.filesystem,
+                ...override.filesystem
+            },
+            confirmation: {
+                ...base.confirmation,
+                ...override.confirmation
+            },
+            logging: {
+                ...base.logging,
+                ...override.logging
+            }
+        };
+    }
+    /**
+     * Validate configuration
+     */
+    validateConfig() {
+        // Validate mode
+        if (!['strict', 'moderate', 'permissive'].includes(this.config.mode)) {
+            throw new Error(`Invalid security mode: ${this.config.mode}`);
+        }
+        // Validate confirmation strategy
+        if (!['interactive', 'policy', 'logging', 'none'].includes(this.config.confirmation.strategy)) {
+            throw new Error(`Invalid confirmation strategy: ${this.config.confirmation.strategy}`);
+        }
+        // Validate timeouts
+        if (this.config.commands.defaultTimeout && this.config.commands.defaultTimeout < 0) {
+            throw new Error('Command timeout must be positive');
+        }
+        if (this.config.confirmation.timeout && this.config.confirmation.timeout < 0) {
+            throw new Error('Confirmation timeout must be positive');
+        }
+    }
+}
+/**
+ * Create example configuration file
+ */
+export async function createExampleConfig(outputPath) {
+    const exampleConfig = {
+        ...DEFAULT_SECURITY_CONFIG,
+        mode: 'moderate',
+        commands: {
+            additionalBlocked: ['example-dangerous-command'],
+            additionalAllowed: ['my-safe-tool'],
+            customRiskLevels: {
+                'npm install': 'medium',
+                'git push': 'high'
+            },
+            defaultTimeout: 60000,
+            maxCommandLength: 2000
+        },
+        filesystem: {
+            additionalAllowedPaths: ['/tmp/my-app', '~/Documents/projects'],
+            additionalBlockedPaths: ['/sensitive/data'],
+            maxFileSize: 50 * 1024 * 1024,
+            allowOutsideProject: false,
+            autoBackup: true,
+            backupDirectory: '.backups'
+        },
+        confirmation: {
+            strategy: 'interactive',
+            autoApproveInDev: true,
+            timeout: 45000,
+            requireConfirmationFor: ['medium', 'high', 'critical'],
+            customPolicies: [
+                {
+                    type: 'command',
+                    pattern: 'npm test',
+                    action: 'approve'
+                },
+                {
+                    type: 'file_operation',
+                    pattern: '/tmp/*',
+                    action: 'approve'
+                }
+            ]
+        },
+        logging: {
+            enabled: true,
+            logPath: './logs/mcp-security.log',
+            includeOutput: true,
+            maxLogSize: 100 * 1024 * 1024,
+            rotation: {
+                enabled: true,
+                maxFiles: 10,
+                maxAge: 30
+            }
+        },
+        platformOverrides: {
+            darwin: {
+                filesystem: {
+                    additionalBlockedPaths: ['/System', '/Library']
+                }
+            },
+            win32: {
+                commands: {
+                    additionalBlocked: ['format', 'diskpart']
+                }
+            }
+        }
+    };
+    const loader = new McpSecurityConfigLoader();
+    await loader.save(exampleConfig, outputPath);
+}
+//# sourceMappingURL=McpSecurityConfig.js.map

package/dist/protocols/mcp/security/McpSecurityConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpSecurityConfig.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAkFjE;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACtD,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,UAAU;IAEhB,QAAQ,EAAE;QACN,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;KACzB;IAED,UAAU,EAAE;QACR,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;QACtC,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,KAAK;KACpB;IAED,YAAY,EAAE;QACV,QAAQ,EAAE,aAAa;QACvB,gBAAgB,EAAE,KAAK;QACvB,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;KAC/C;IAED,OAAO,EAAE;QACL,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO;KACvC;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,uBAAuB;IACxB,MAAM,GAAsB,uBAAuB,CAAC;IACpD,UAAU,CAAU;IAE5B,YAAY,UAAmB;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACN,IAAI,CAAC;YACD,mCAAmC;YACnC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnB,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAClD,CAAC;YAED,+BAA+B;YAC/B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA+B,CAAC;gBACxE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;YACzE,CAAC;YAED,uCAAuC;YACvC,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAEjC,oCAAoC;YACpC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAE9B,yBAAyB;YACzB,IAAI,CAAC,cAAc,EAAE,CAAC;YAEtB,OAAO,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,mCAAmC,KAAK,mBAAmB,CAAC,CAAC;YACzE,OAAO,uBAAuB,CAAC;QACnC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,MAAyB,EAAE,UAAmB;QACrD,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE9E,IAAI,CAAC;YACD,0BAA0B;YAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5D,eAAe;YACf,MAAM,EAAE,CAAC,SAAS,CACd,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAC/B,MAAM,CACT,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QACxB,MAAM,SAAS,GAAG;YACd,oBAAoB;YACpB,mBAAmB;YACnB,oBAAoB;YACpB,mBAAmB;YACnB,0BAA0B;YAC1B,2BAA2B;YAC3B,iBAAiB;YACjB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,oBAAoB,CAAC;SACrF,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,uBAAuB;gBACvB,IAAI,CAAC;oBACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC1B,OAAO,QAAQ,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACL,gDAAgD;gBACpD,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACL,4BAA4B;YAChC,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,oBAAoB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACK,yBAAyB;QAC7B,uBAAuB;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;QACtE,CAAC;QAED,oBAAoB;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAwB,CAAC;QAC5D,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QAC9E,CAAC;QAED,gCAAgC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAgB;gBACrC,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,MAAM,CAAC;QAC7D,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACpE,CAAC;IACL,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAsD,CAAC;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAED;;OAEG;IACK,YAAY,CAChB,IAAuB,EACvB,QAAoC;QAEpC,OAAO;YACH,GAAG,IAAI;YACP,GAAG,QAAQ;YACX,QAAQ,EAAE;gBACN,GAAG,IAAI,CAAC,QAAQ;gBAChB,GAAG,QAAQ,CAAC,QAAQ;aACvB;YACD,UAAU,EAAE;gBACR,GAAG,IAAI,CAAC,UAAU;gBAClB,GAAG,QAAQ,CAAC,UAAU;aACzB;YACD,YAAY,EAAE;gBACV,GAAG,IAAI,CAAC,YAAY;gBACpB,GAAG,QAAQ,CAAC,YAAY;aAC3B;YACD,OAAO,EAAE;gBACL,GAAG,IAAI,CAAC,OAAO;gBACf,GAAG,QAAQ,CAAC,OAAO;aACtB;SACJ,CAAC;IACN,CAAC;IAED;;OAEG;IACK,cAAc;QAClB,gBAAgB;QAChB,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CACtD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CACpC,EAAE,CAAC;YACA,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,oBAAoB;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;IACL,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAmB;IACzD,MAAM,aAAa,GAAsB;QACrC,GAAG,uBAAuB;QAC1B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACN,iBAAiB,EAAE,CAAC,2BAA2B,CAAC;YAChD,iBAAiB,EAAE,CAAC,cAAc,CAAC;YACnC,gBAAgB,EAAE;gBACd,aAAa,EAAE,QAAQ;gBACvB,UAAU,EAAE,MAAM;aACrB;YACD,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE;YACR,sBAAsB,EAAE,CAAC,aAAa,EAAE,sBAAsB,CAAC;YAC/D,sBAAsB,EAAE,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC7B,mBAAmB,EAAE,KAAK;YAC1B,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,UAAU;SAC9B;QACD,YAAY,EAAE;YACV,QAAQ,EAAE,aAAa;YACvB,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,KAAK;YACd,sBAAsB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;YACtD,cAAc,EAAE;gBACZ;oBACI,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,SAAS;iBACpB;gBACD;oBACI,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,SAAS;iBACpB;aACJ;SACJ;QACD,OAAO,EAAE;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,yBAAyB;YAClC,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC7B,QAAQ,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,EAAE;aACb;SACJ;QACD,iBAAiB,EAAE;YACf,MAAM,EAAE;gBACJ,UAAU,EAAE;oBACR,sBAAsB,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;iBAClD;aACJ;YACD,KAAK,EAAE;gBACH,QAAQ,EAAE;oBACN,iBAAiB,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;iBAC5C;aACJ;SACJ;KACJ,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC"}

package/dist/protocols/mcp/security/McpSecurityGuard.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/mxf-dev/mxf
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+export interface SecurityContext {
+    agentId: string;
+    channelId: string;
+    requestId: string;
+    userId?: string;
+    permissions?: string[];
+}
+export interface CommandValidationResult {
+    allowed: boolean;
+    reason?: string;
+    requiresConfirmation?: boolean;
+    riskLevel?: 'low' | 'medium' | 'high' | 'critical';
+    /** Informational warnings about destructive patterns detected in the command */
+    warnings?: string[];
+}
+export interface PathValidationResult {
+    allowed: boolean;
+    reason?: string;
+    resolvedPath?: string;
+}
+export declare class McpSecurityGuard {
+    private platform;
+    private projectRoot;
+    private allowedPaths;
+    constructor(projectRoot: string, additionalAllowedPaths?: string[]);
+    /**
+     * Validate a shell command for execution.
+     *
+     * Uses the ShellCommandParser to extract ALL effective commands from compound
+     * expressions (e.g., `echo hello; rm -rf /`) and validates each one individually.
+     * This prevents security bypass via command chaining.
+     *
+     * Also integrates CommandClassification to allow read-only commands without
+     * confirmation, and DestructiveCommandWarnings for informational warnings.
+     */
+    validateCommand(command: string, context: SecurityContext): CommandValidationResult;
+    /**
+     * Validate a single (non-compound) command against security rules.
+     */
+    private validateSingleCommand;
+    /**
+     * Numeric rank for risk levels, used to find the most restrictive result
+     * across compound commands.
+     */
+    private riskRank;
+    /**
+     * Validate a file system path
+     */
+    validatePath(requestedPath: string, operation: 'read' | 'write' | 'delete'): PathValidationResult;
+    /**
+     * Check if a command should trigger a confirmation prompt
+     */
+    requiresConfirmation(command: string, context: SecurityContext): boolean;
+    /**
+     * Get risk level for a command
+     */
+    getRiskLevel(command: string, context: SecurityContext): 'low' | 'medium' | 'high' | 'critical';
+    /**
+     * Add allowed paths dynamically
+     */
+    addAllowedPath(pathToAdd: string): void;
+    /**
+     * Helper to check for dangerous patterns in commands
+     */
+    private containsDangerousPattern;
+    /**
+     * Helper to expand environment variables and ~ in paths
+     */
+    private expandPath;
+}
+export declare function getSecurityGuard(projectRoot?: string): McpSecurityGuard;
+//# sourceMappingURL=McpSecurityGuard.d.ts.map

package/dist/protocols/mcp/security/McpSecurityGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpSecurityGuard.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AA+ID,qBAAa,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAgB;gBAExB,WAAW,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,EAAE;IAOlE;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,uBAAuB;IA8DnF;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAUhB;;OAEG;IACH,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,oBAAoB;IAiFjG;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO;IAKxE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU;IAK/F;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAOvC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAahC;;OAEG;IACH,OAAO,CAAC,UAAU;CAcrB;AAOD,wBAAgB,gBAAgB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAQvE"}