@mxf-dev/core 1.0.0

package/dist/protocols/mcp/security/McpSecurityGuard.js

@@ -0,0 +1,458 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/mxf-dev/mxf
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * McpSecurityGuard.ts
+ *
+ * Comprehensive security module for MCP tools providing OS-specific guardrails,
+ * command validation, path restrictions, and destructive operation protection.
+ */
+import { Logger } from '../../../utils/Logger.js';
+import { platform } from 'os';
+import * as path from 'path';
+import { extractEffectiveCommands, parseCommand } from '../tools/shell/ShellCommandParser.js';
+import { classifyCommand } from '../tools/shell/CommandClassification.js';
+import { getDestructiveWarnings } from '../tools/shell/DestructiveCommandWarnings.js';
+const logger = new Logger('info', 'McpSecurityGuard', 'server');
+/**
+ * OS-specific command security rules
+ */
+const OS_COMMAND_RULES = {
+    darwin: {
+        // macOS specific dangerous commands
+        blocked: [
+            // Disk operations
+            'diskutil', 'hdiutil', 'pdisk', 'gpt', 'newfs_*',
+            // System modifications
+            'nvram', 'systemsetup', 'scutil', 'launchctl',
+            // Security bypass
+            'csrutil', 'spctl', 'codesign',
+            // User management
+            'dscl', 'sysadminctl', 'dseditgroup',
+            // Network
+            'pfctl', 'dnscacheutil', 'route',
+            // Dangerous utilities
+            'purge', 'ditto', 'rsync', 'dd'
+        ],
+        restricted: [
+            // Requires confirmation
+            { command: 'defaults', riskLevel: 'medium' },
+            { command: 'osascript', riskLevel: 'high' },
+            { command: 'security', riskLevel: 'high' },
+            { command: 'networksetup', riskLevel: 'high' }
+        ]
+    },
+    win32: {
+        // Windows specific dangerous commands
+        blocked: [
+            // Disk operations
+            'format', 'diskpart', 'chkdsk', 'convert', 'defrag',
+            // System modifications
+            'bcdedit', 'regedit', 'reg', 'regsvr32', 'rundll32',
+            'sfc', 'dism', 'wmic', 'wevtutil',
+            // Security
+            'cipher', 'schtasks', 'sc', 'netsh',
+            // User management
+            'net user', 'net localgroup', 'wuauclt',
+            // Dangerous utilities
+            'takeown', 'icacls', 'attrib', 'assoc'
+        ],
+        restricted: [
+            { command: 'powershell', riskLevel: 'high' },
+            { command: 'cmd', riskLevel: 'medium' },
+            { command: 'wsl', riskLevel: 'medium' },
+            { command: 'msiexec', riskLevel: 'high' }
+        ]
+    },
+    linux: {
+        // Linux specific dangerous commands
+        blocked: [
+            // Disk operations
+            'mkfs', 'fdisk', 'parted', 'dd', 'shred',
+            // System modifications
+            'systemctl', 'service', 'update-rc.d', 'chkconfig',
+            'modprobe', 'insmod', 'rmmod',
+            // Package management (require explicit permission)
+            'apt-get', 'yum', 'dnf', 'zypper', 'pacman', 'snap',
+            // User management
+            'useradd', 'userdel', 'usermod', 'passwd', 'groupadd',
+            // Network
+            'iptables', 'ip6tables', 'ufw', 'firewall-cmd',
+            // Dangerous utilities
+            'mount', 'umount', 'chroot', 'pivot_root'
+        ],
+        restricted: [
+            { command: 'crontab', riskLevel: 'high' },
+            { command: 'at', riskLevel: 'medium' },
+            { command: 'visudo', riskLevel: 'critical' },
+            { command: 'dpkg', riskLevel: 'high' }
+        ]
+    }
+};
+/**
+ * Common dangerous commands across all platforms
+ */
+const COMMON_DANGEROUS_COMMANDS = [
+    // Destructive operations
+    'rm -rf', 'rm -fr', 'del /s', 'del /f',
+    // Privilege escalation
+    'sudo', 'su', 'doas', 'runas',
+    // System shutdown
+    'shutdown', 'reboot', 'halt', 'poweroff',
+    // Process management
+    'kill -9', 'killall', 'pkill -9',
+    // Dangerous redirections
+    '> /dev/sda', '> /dev/null', '> /dev/zero'
+];
+/**
+ * Safe command allowlist for common operations
+ */
+const SAFE_COMMANDS = [
+    // File operations
+    'ls', 'dir', 'pwd', 'cd', 'find', 'grep', 'cat', 'head', 'tail',
+    'less', 'more', 'wc', 'sort', 'uniq', 'diff', 'file',
+    // Text processing
+    'sed', 'awk', 'cut', 'tr', 'echo', 'printf',
+    // Archive operations
+    'tar', 'zip', 'unzip', 'gzip', 'gunzip',
+    // Network utilities (read-only)
+    'ping', 'nslookup', 'dig', 'host', 'curl', 'wget',
+    // Development tools
+    'git', 'npm', 'yarn', 'pnpm', 'python', 'node', 'java',
+    'gcc', 'g++', 'make', 'cmake',
+    // System info (read-only)
+    'whoami', 'hostname', 'uname', 'date', 'uptime', 'df', 'du',
+    'ps', 'top', 'htop', 'free', 'vmstat'
+];
+/**
+ * Path security rules
+ */
+const PATH_RESTRICTIONS = {
+    // Paths that should never be accessed
+    blockedPaths: {
+        darwin: [
+            '/System', '/Library/Security', '/private/etc',
+            '/usr/bin', '/usr/sbin', '/private/var/db'
+        ],
+        win32: [
+            'C:\\Windows\\System32', 'C:\\Windows\\SysWOW64',
+            'C:\\Program Files', 'C:\\Program Files (x86)',
+            'C:\\ProgramData', 'C:\\Users\\All Users'
+        ],
+        linux: [
+            '/etc', '/bin', '/sbin', '/usr/bin', '/usr/sbin',
+            '/boot', '/root', '/proc', '/sys', '/dev'
+        ]
+    },
+    // Paths that require confirmation
+    sensitivePaths: {
+        darwin: ['~/Library', '~/.ssh', '~/.gnupg'],
+        win32: ['%APPDATA%', '%LOCALAPPDATA%', '%USERPROFILE%\\.ssh'],
+        linux: ['~/.ssh', '~/.gnupg', '~/.config', '/var']
+    }
+};
+export class McpSecurityGuard {
+    platform;
+    projectRoot;
+    allowedPaths = [];
+    constructor(projectRoot, additionalAllowedPaths) {
+        this.platform = platform();
+        this.projectRoot = path.resolve(projectRoot);
+        this.allowedPaths = [this.projectRoot, ...(additionalAllowedPaths || [])];
+    }
+    /**
+     * Validate a shell command for execution.
+     *
+     * Uses the ShellCommandParser to extract ALL effective commands from compound
+     * expressions (e.g., `echo hello; rm -rf /`) and validates each one individually.
+     * This prevents security bypass via command chaining.
+     *
+     * Also integrates CommandClassification to allow read-only commands without
+     * confirmation, and DestructiveCommandWarnings for informational warnings.
+     */
+    validateCommand(command, context) {
+        const normalizedCommand = command.trim().toLowerCase();
+        // Use the parser to extract all effective commands from compound expressions.
+        // This prevents bypass via `echo hello; rm -rf /` where only `echo` was validated.
+        const parsed = parseCommand(command);
+        const effectiveCommands = extractEffectiveCommands(command);
+        // Subshell constructs ($() or backticks) cannot be safely parsed — the parser
+        // detects their presence but doesn't extract commands inside them. Require
+        // confirmation so agents can't bypass validation with `echo $(rm -rf /)`.
+        if (parsed.hasSubshells) {
+            const destructiveWarnings = getDestructiveWarnings(command);
+            const warningMessages = destructiveWarnings.length > 0
+                ? destructiveWarnings.map(w => w.warning)
+                : undefined;
+            return {
+                allowed: true,
+                requiresConfirmation: true,
+                reason: 'Command contains subshell constructs ($() or backticks) that cannot be statically validated',
+                riskLevel: 'high',
+                warnings: warningMessages
+            };
+        }
+        // Collect destructive warnings (informational, does not block)
+        const destructiveWarnings = getDestructiveWarnings(command);
+        const warningMessages = destructiveWarnings.length > 0
+            ? destructiveWarnings.map(w => w.warning)
+            : undefined;
+        // Track the most restrictive result across all commands in the expression
+        let mostRestrictiveResult = {
+            allowed: true,
+            riskLevel: 'low',
+            warnings: warningMessages
+        };
+        // Validate each effective command independently
+        for (const effectiveCmd of effectiveCommands) {
+            const result = this.validateSingleCommand(effectiveCmd, normalizedCommand, context);
+            if (!result.allowed) {
+                // Any blocked command blocks the whole expression
+                return { ...result, warnings: warningMessages };
+            }
+            // Escalate risk level and confirmation requirement
+            if (this.riskRank(result.riskLevel) > this.riskRank(mostRestrictiveResult.riskLevel)) {
+                mostRestrictiveResult = { ...result, warnings: warningMessages };
+            }
+            else if (result.requiresConfirmation && !mostRestrictiveResult.requiresConfirmation) {
+                mostRestrictiveResult = { ...result, warnings: warningMessages };
+            }
+        }
+        // If the overall command is classified as read-only, skip confirmation
+        const classification = classifyCommand(command);
+        if (classification.isReadOnly && mostRestrictiveResult.requiresConfirmation) {
+            mostRestrictiveResult.requiresConfirmation = false;
+        }
+        return mostRestrictiveResult;
+    }
+    /**
+     * Validate a single (non-compound) command against security rules.
+     */
+    validateSingleCommand(effectiveCommand, fullNormalizedCommand, _context) {
+        const normalizedCmd = effectiveCommand.trim().toLowerCase();
+        const baseCommand = normalizedCmd.split(/\s+/)[0];
+        // Check if command is in safe allowlist
+        if (SAFE_COMMANDS.includes(baseCommand)) {
+            // Still check for dangerous patterns
+            if (this.containsDangerousPattern(fullNormalizedCommand)) {
+                return {
+                    allowed: false,
+                    reason: 'Command contains dangerous patterns',
+                    riskLevel: 'high'
+                };
+            }
+            return { allowed: true, riskLevel: 'low' };
+        }
+        // Check common dangerous commands
+        for (const dangerous of COMMON_DANGEROUS_COMMANDS) {
+            if (normalizedCmd.includes(dangerous)) {
+                return {
+                    allowed: false,
+                    reason: `Command contains dangerous pattern: ${dangerous}`,
+                    riskLevel: 'critical'
+                };
+            }
+        }
+        // Check OS-specific rules
+        const osRules = OS_COMMAND_RULES[this.platform] || OS_COMMAND_RULES.linux;
+        // Check blocked commands
+        for (const blocked of osRules.blocked) {
+            if (normalizedCmd.includes(blocked)) {
+                return {
+                    allowed: false,
+                    reason: `Command '${blocked}' is blocked on ${this.platform}`,
+                    riskLevel: 'critical'
+                };
+            }
+        }
+        // Check restricted commands
+        for (const restricted of osRules.restricted) {
+            if (baseCommand === restricted.command) {
+                return {
+                    allowed: true,
+                    requiresConfirmation: true,
+                    reason: `Command '${restricted.command}' requires confirmation`,
+                    riskLevel: restricted.riskLevel
+                };
+            }
+        }
+        // Unknown command - require confirmation
+        return {
+            allowed: true,
+            requiresConfirmation: true,
+            reason: 'Unknown command requires confirmation',
+            riskLevel: 'medium'
+        };
+    }
+    /**
+     * Numeric rank for risk levels, used to find the most restrictive result
+     * across compound commands.
+     */
+    riskRank(level) {
+        switch (level) {
+            case 'critical': return 4;
+            case 'high': return 3;
+            case 'medium': return 2;
+            case 'low': return 1;
+            default: return 0;
+        }
+    }
+    /**
+     * Validate a file system path
+     */
+    validatePath(requestedPath, operation) {
+        try {
+            // Resolve the path
+            const resolvedPath = path.resolve(requestedPath);
+            // Check for path traversal attempts
+            if (requestedPath.includes('..') || requestedPath.includes('~')) {
+                // Allow ~ only at the beginning for home directory
+                if (requestedPath.startsWith('~')) {
+                    const homePath = process.env.HOME || process.env.USERPROFILE || '';
+                    const expandedPath = requestedPath.replace('~', homePath);
+                    return this.validatePath(expandedPath, operation);
+                }
+                return {
+                    allowed: false,
+                    reason: 'Path traversal attempts are not allowed'
+                };
+            }
+            // Check blocked paths
+            const blockedPaths = PATH_RESTRICTIONS.blockedPaths[this.platform] || [];
+            for (const blocked of blockedPaths) {
+                const expandedBlocked = this.expandPath(blocked);
+                if (resolvedPath.startsWith(expandedBlocked)) {
+                    return {
+                        allowed: false,
+                        reason: `Access to ${blocked} is blocked`
+                    };
+                }
+            }
+            // Check if path is within allowed directories
+            let isInAllowedPath = false;
+            for (const allowedPath of this.allowedPaths) {
+                const resolvedAllowed = path.resolve(allowedPath);
+                if (resolvedPath.startsWith(resolvedAllowed)) {
+                    isInAllowedPath = true;
+                    break;
+                }
+            }
+            // If not in allowed paths, check if it's a sensitive path
+            if (!isInAllowedPath) {
+                const sensitivePaths = PATH_RESTRICTIONS.sensitivePaths[this.platform] || [];
+                for (const sensitive of sensitivePaths) {
+                    const expandedSensitive = this.expandPath(sensitive);
+                    if (resolvedPath.startsWith(expandedSensitive)) {
+                        return {
+                            allowed: operation === 'read', // Allow read, block write/delete
+                            reason: operation !== 'read'
+                                ? `Write/delete operations to ${sensitive} require explicit permission`
+                                : undefined,
+                            resolvedPath
+                        };
+                    }
+                }
+                // Path is outside project - require explicit permission for write/delete
+                if (operation !== 'read') {
+                    return {
+                        allowed: false,
+                        reason: 'Write/delete operations outside project directory require explicit permission',
+                        resolvedPath
+                    };
+                }
+            }
+            return {
+                allowed: true,
+                resolvedPath
+            };
+        }
+        catch (error) {
+            return {
+                allowed: false,
+                reason: `Invalid path: ${error instanceof Error ? error.message : String(error)}`
+            };
+        }
+    }
+    /**
+     * Check if a command should trigger a confirmation prompt
+     */
+    requiresConfirmation(command, context) {
+        const validation = this.validateCommand(command, context);
+        return validation.requiresConfirmation || false;
+    }
+    /**
+     * Get risk level for a command
+     */
+    getRiskLevel(command, context) {
+        const validation = this.validateCommand(command, context);
+        return validation.riskLevel || 'low';
+    }
+    /**
+     * Add allowed paths dynamically
+     */
+    addAllowedPath(pathToAdd) {
+        const resolved = path.resolve(pathToAdd);
+        if (!this.allowedPaths.includes(resolved)) {
+            this.allowedPaths.push(resolved);
+        }
+    }
+    /**
+     * Helper to check for dangerous patterns in commands
+     */
+    containsDangerousPattern(command) {
+        const patterns = [
+            /rm\s+-[rf]+\s+\//, // rm -rf on root paths
+            />\s*\/dev\//, // Redirecting to device files
+            /dd\s+.*of=\//, // dd writing to root paths
+            /chmod\s+777/, // Overly permissive permissions
+            /curl.*\|\s*sh/, // Curl piped to shell
+            /wget.*\|\s*bash/ // Wget piped to shell
+        ];
+        return patterns.some(pattern => pattern.test(command));
+    }
+    /**
+     * Helper to expand environment variables and ~ in paths
+     */
+    expandPath(pathStr) {
+        // Expand ~
+        if (pathStr.startsWith('~')) {
+            const home = process.env.HOME || process.env.USERPROFILE || '';
+            pathStr = pathStr.replace('~', home);
+        }
+        // Expand environment variables
+        pathStr = pathStr.replace(/%([^%]+)%/g, (_, varName) => {
+            return process.env[varName] || '';
+        });
+        return path.resolve(pathStr);
+    }
+}
+/**
+ * Singleton instance factory
+ */
+let securityGuardInstance = null;
+export function getSecurityGuard(projectRoot) {
+    if (!securityGuardInstance && projectRoot) {
+        securityGuardInstance = new McpSecurityGuard(projectRoot);
+    }
+    if (!securityGuardInstance) {
+        throw new Error('McpSecurityGuard not initialized. Please provide projectRoot on first call.');
+    }
+    return securityGuardInstance;
+}
+//# sourceMappingURL=McpSecurityGuard.js.map

package/dist/protocols/mcp/security/McpSecurityGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpSecurityGuard.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/McpSecurityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAEtF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;AAyBhE;;GAEG;AACH,MAAM,gBAAgB,GAAG;IACrB,MAAM,EAAE;QACJ,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;YAChD,uBAAuB;YACvB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW;YAC7C,kBAAkB;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,kBAAkB;YAClB,MAAM,EAAE,aAAa,EAAE,aAAa;YACpC,UAAU;YACV,OAAO,EAAE,cAAc,EAAE,OAAO;YAChC,sBAAsB;YACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;SAClC;QACD,UAAU,EAAE;YACR,wBAAwB;YACxB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC5C,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;YAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE;YAC1C,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE;SACjD;KACJ;IACD,KAAK,EAAE;QACH,sCAAsC;QACtC,OAAO,EAAE;YACL,kBAAkB;YAClB,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;YACnD,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU;YACnD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;YACjC,WAAW;YACX,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO;YACnC,kBAAkB;YAClB,UAAU,EAAE,gBAAgB,EAAE,SAAS;YACvC,sBAAsB;YACtB,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;SACzC;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YACvC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;SAC5C;KACJ;IACD,KAAK,EAAE;QACH,oCAAoC;QACpC,OAAO,EAAE;YACL,kBAAkB;YAClB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO;YACxC,uBAAuB;YACvB,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW;YAClD,UAAU,EAAE,QAAQ,EAAE,OAAO;YAC7B,mDAAmD;YACnD,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YACnD,kBAAkB;YAClB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACrD,UAAU;YACV,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc;YAC9C,sBAAsB;YACtB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY;SAC5C;QACD,UAAU,EAAE;YACR,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE;YACzC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;YAC5C,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;SACzC;KACJ;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAC9B,yBAAyB;IACzB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACtC,uBAAuB;IACvB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;IAC7B,kBAAkB;IAClB,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;IACxC,qBAAqB;IACrB,SAAS,EAAE,SAAS,EAAE,UAAU;IAChC,yBAAyB;IACzB,YAAY,EAAE,aAAa,EAAE,aAAa;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG;IAClB,kBAAkB;IAClB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC/D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpD,kBAAkB;IAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ;IAC3C,qBAAqB;IACrB,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACvC,gCAAgC;IAChC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjD,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACtD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC7B,0BAA0B;IAC1B,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI;IAC3D,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;CACxC,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,YAAY,EAAE;QACV,MAAM,EAAE;YACJ,SAAS,EAAE,mBAAmB,EAAE,cAAc;YAC9C,UAAU,EAAE,WAAW,EAAE,iBAAiB;SAC7C;QACD,KAAK,EAAE;YACH,uBAAuB,EAAE,uBAAuB;YAChD,mBAAmB,EAAE,yBAAyB;YAC9C,iBAAiB,EAAE,sBAAsB;SAC5C;QACD,KAAK,EAAE;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW;YAChD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;SAC5C;KACJ;IACD,kCAAkC;IAClC,cAAc,EAAE;QACZ,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC3C,KAAK,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;KACrD;CACJ,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACjB,QAAQ,CAAkB;IAC1B,WAAW,CAAS;IACpB,YAAY,GAAa,EAAE,CAAC;IAEpC,YAAY,WAAmB,EAAE,sBAAiC;QAC9D,IAAI,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IAE9E,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAe,EAAE,OAAwB;QACrD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEvD,8EAA8E;QAC9E,mFAAmF;QACnF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE5D,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;gBAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,oBAAoB,EAAE,IAAI;gBAC1B,MAAM,EAAE,6FAA6F;gBACrG,SAAS,EAAE,MAAM;gBACjB,QAAQ,EAAE,eAAe;aAC5B,CAAC;QACN,CAAC;QAED,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YAClD,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;QAEhB,0EAA0E;QAC1E,IAAI,qBAAqB,GAA4B;YACjD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,eAAe;SAC5B,CAAC;QAEF,gDAAgD;QAChD,KAAK,MAAM,YAAY,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,kDAAkD;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACpD,CAAC;YACD,mDAAmD;YACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;iBAAM,IAAI,MAAM,CAAC,oBAAoB,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;gBACpF,qBAAqB,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;YACrE,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,cAAc,CAAC,UAAU,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,CAAC;YAC1E,qBAAqB,CAAC,oBAAoB,GAAG,KAAK,CAAC;QACvD,CAAC;QAED,OAAO,qBAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,qBAAqB,CACzB,gBAAwB,EACxB,qBAA6B,EAC7B,QAAyB;QAEzB,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,wCAAwC;QACxC,IAAI,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,qCAAqC;YACrC,IAAI,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qCAAqC;oBAC7C,SAAS,EAAE,MAAM;iBACpB,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,kCAAkC;QAClC,KAAK,MAAM,SAAS,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,uCAAuC,SAAS,EAAE;oBAC1D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAyC,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAE3G,yBAAyB;QACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,YAAY,OAAO,mBAAmB,IAAI,CAAC,QAAQ,EAAE;oBAC7D,SAAS,EAAE,UAAU;iBACxB,CAAC;YACN,CAAC;QACL,CAAC;QAED,4BAA4B;QAC5B,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,oBAAoB,EAAE,IAAI;oBAC1B,MAAM,EAAE,YAAY,UAAU,CAAC,OAAO,yBAAyB;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAgB;iBACzC,CAAC;YACN,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,OAAO;YACH,OAAO,EAAE,IAAI;YACb,oBAAoB,EAAE,IAAI;YAC1B,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,QAAQ;SACtB,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8C;QAC3D,QAAQ,KAAK,EAAE,CAAC;YACZ,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,aAAqB,EAAE,SAAsC;QACtE,IAAI,CAAC;YACD,mBAAmB;YACnB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEjD,oCAAoC;YACpC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,mDAAmD;gBACnD,IAAI,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;oBACnE,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBAC1D,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,yCAAyC;iBACpD,CAAC;YACN,CAAC;YAED,sBAAsB;YACtB,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,QAAuD,CAAC,IAAI,EAAE,CAAC;YACxH,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACjC,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,aAAa,OAAO,aAAa;qBAC5C,CAAC;gBACN,CAAC;YACL,CAAC;YAED,8CAA8C;YAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC3C,eAAe,GAAG,IAAI,CAAC;oBACvB,MAAM;gBACV,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,QAAyD,CAAC,IAAI,EAAE,CAAC;gBAC9H,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;oBACrC,MAAM,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;oBACrD,IAAI,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAC7C,OAAO;4BACH,OAAO,EAAE,SAAS,KAAK,MAAM,EAAE,iCAAiC;4BAChE,MAAM,EAAE,SAAS,KAAK,MAAM;gCACxB,CAAC,CAAC,8BAA8B,SAAS,8BAA8B;gCACvE,CAAC,CAAC,SAAS;4BACf,YAAY;yBACf,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,yEAAyE;gBACzE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACvB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,+EAA+E;wBACvF,YAAY;qBACf,CAAC;gBACN,CAAC;YACL,CAAC;YAED,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,YAAY;aACf,CAAC;QAEN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe,EAAE,OAAwB;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,OAAwB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAG;YACb,kBAAkB,EAAG,uBAAuB;YAC5C,aAAa,EAAQ,8BAA8B;YACnD,cAAc,EAAO,2BAA2B;YAChD,aAAa,EAAQ,gCAAgC;YACrD,eAAe,EAAM,sBAAsB;YAC3C,iBAAiB,CAAI,sBAAsB;SAC9C,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAe;QAC9B,WAAW;QACX,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,+BAA+B;QAC/B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;YACnD,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;CACJ;AAED;;GAEG;AACH,IAAI,qBAAqB,GAA4B,IAAI,CAAC;AAE1D,MAAM,UAAU,gBAAgB,CAAC,WAAoB;IACjD,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE,CAAC;QACxC,qBAAqB,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,qBAAqB,CAAC;AACjC,CAAC"}

package/dist/protocols/mcp/security/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/mxf-dev/mxf
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * Security module exports
+ *
+ * Comprehensive security framework for MCP tools
+ */
+export * from './McpSecurityGuard.js';
+export * from './McpConfirmationManager.js';
+export * from './McpSecurityConfig.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/protocols/mcp/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC"}

package/dist/protocols/mcp/security/index.js

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2024 Brad Anderson
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * @author Brad Anderson <BradA1878@pm.me>
+ * @repository https://github.com/mxf-dev/mxf
+ * @documentation https://mxf-dev.github.io/mxf/
+ */
+/**
+ * Security module exports
+ *
+ * Comprehensive security framework for MCP tools
+ */
+export * from './McpSecurityGuard.js';
+export * from './McpConfirmationManager.js';
+export * from './McpSecurityConfig.js';
+//# sourceMappingURL=index.js.map

package/dist/protocols/mcp/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/protocols/mcp/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC"}