@raghulm/aegis-mcp 1.0.4 → 1.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +286 -290
- package/audit/audit_logger.py +62 -62
- package/package.json +5 -6
- package/policies/roles.yaml +34 -34
- package/policies/scope_rules.yaml +16 -16
- package/requirements.txt +8 -7
- package/run_stdio.py +22 -22
- package/server/auth.py +69 -69
- package/server/config.py +82 -82
- package/server/health.py +19 -19
- package/server/logging.py +33 -33
- package/server/main.py +212 -144
- package/server/stdio.py +7 -7
- package/tools/aws/ec2.py +26 -26
- package/tools/aws/s3.py +54 -54
- package/tools/cicd/jenkins.py +256 -0
- package/tools/cicd/pipeline.py +33 -33
- package/tools/git/repo.py +22 -22
- package/tools/kubernetes/audit.py +108 -108
- package/tools/kubernetes/pods.py +27 -27
- package/tools/network/headers.py +99 -99
- package/tools/network/port_scanner.py +66 -66
- package/tools/network/ssl_checker.py +65 -65
- package/tools/security/deps.py +103 -103
- package/tools/security/secrets.py +91 -91
- package/tools/security/semgrep.py +261 -261
- package/tools/security/trivy.py +19 -19
package/README.md
CHANGED
|
@@ -1,162 +1,179 @@
|
|
|
1
|
-
<div align="center">
|
|
2
|
-
<
|
|
3
|
-
<
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
[](https://opensource.org/licenses/MIT)
|
|
7
|
+
[](https://www.python.org/downloads/)
|
|
8
|
+
[](https://modelcontextprotocol.io/)
|
|
9
|
+
[](https://www.docker.com/)
|
|
10
|
+
</div>
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
**Aegis MCP Server** empowers AI assistants (like Claude, Cursor, and GitHub Copilot) to perform cloud architecture administration, security scanning, and network analyses directly from their execution environments. It wraps powerful underlying tools and SDKs into secure, audited MCP tool sets.
|
|
15
|
+
|
|
16
|
+
---
|
|
17
|
+
|
|
18
|
+
## 📸 Demo in Action
|
|
19
|
+
|
|
20
|
+
```text
|
|
21
|
+
AI Agent: "Check if any S3 bucket is publicly accessible"
|
|
22
|
+
|
|
23
|
+
Tool call → aws_check_s3_public_access
|
|
24
|
+
Result → bucket audit report
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
<p align="center">
|
|
28
|
+
<img src="docs/demo-aegis.gif" width="900"/>
|
|
29
|
+
</p>
|
|
30
|
+
|
|
31
|
+
---
|
|
32
|
+
|
|
33
|
+
## 🌟 Key Features
|
|
34
|
+
|
|
35
|
+
- 🚀 **FastMCP Server** — Exposes domain-specific tools for AWS, Kubernetes, security scanning, Git, network analysis, Jenkins, and CI/CD pipelines.
|
|
36
|
+
- 🔐 **Flexible Authorization** — JWT-based RBAC for production deployments; automatically disabled for local stdio sessions (Claude Desktop, Agent IDEs).
|
|
37
|
+
- 📜 **Structured Audit Logging** — Emits clean JSON audit logs for every invocation, suitable for SIEM integrations.
|
|
38
|
+
- 🛠 **Expandable Tooling** — Easily add new integrations. Includes ready-to-use scanners for dependencies, secrets, SSL/TLS certs, Semgrep, Trivy, and more.
|
|
39
|
+
- 📦 **Docker Ready** — Containerized deployment using a non-root runtime with built-in health checks.
|
|
40
|
+
- 🌐 **ASGI Integration** — FastAPI health endpoint alongside MCP streamable-http transport.
|
|
41
|
+
|
|
42
|
+
---
|
|
43
|
+
|
|
44
|
+
## 📐 Architecture
|
|
45
|
+
|
|
46
|
+
```mermaid
|
|
47
|
+
flowchart TD
|
|
48
|
+
Client[MCP Client / AI Agent] -->|Tool Call| AuthZ[Auth & RBAC Layer]
|
|
49
|
+
|
|
50
|
+
subgraph aegis-mcp["Aegis MCP Server"]
|
|
51
|
+
AuthZ --> Audit[Audit Logger]
|
|
52
|
+
Audit --> ToolsLayer[Tool Dispatch Layer]
|
|
53
|
+
end
|
|
54
|
+
|
|
55
|
+
ToolsLayer --> AWS[AWS SDK]
|
|
56
|
+
ToolsLayer --> K8s[kubectl / K8s SDK]
|
|
57
|
+
ToolsLayer --> Sec[Trivy / Semgrep]
|
|
58
|
+
ToolsLayer --> Net[Nmap / SSL]
|
|
59
|
+
ToolsLayer --> Git[Git CLI]
|
|
60
|
+
ToolsLayer --> Jenkins[Jenkins API]
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
The server receives MCP tool-call requests over **streamable HTTP** or **stdio** transport. In HTTP mode, each request requires a JWT bearer token for authorization. In stdio mode (local usage), authorization is automatically disabled.
|
|
64
|
+
|
|
65
|
+
---
|
|
66
|
+
|
|
67
|
+
## 📂 Repository Structure
|
|
68
|
+
|
|
69
|
+
```text
|
|
70
|
+
aegis-mcp/
|
|
71
|
+
│
|
|
72
|
+
├── server/
|
|
73
|
+
│ ├── main.py
|
|
74
|
+
│ ├── health.py
|
|
75
|
+
│ ├── auth.py
|
|
76
|
+
│ └── tools/
|
|
77
|
+
│ ├── aws/
|
|
78
|
+
│ ├── cicd/ # Jenkins + pipeline tools
|
|
79
|
+
│ ├── kubernetes/
|
|
80
|
+
│ ├── security/
|
|
81
|
+
│ └── network/
|
|
82
|
+
│
|
|
83
|
+
├── policies/
|
|
84
|
+
├── tests/
|
|
85
|
+
├── Dockerfile
|
|
86
|
+
└── run_stdio.py
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
---
|
|
90
|
+
|
|
91
|
+
## 🧰 Available Tools
|
|
92
|
+
|
|
93
|
+
### Example Tool Invocation
|
|
94
|
+
|
|
95
|
+
```text
|
|
96
|
+
Tool: security_run_trivy_scan
|
|
97
|
+
|
|
98
|
+
Input:
|
|
99
|
+
image=nginx:latest
|
|
100
|
+
|
|
101
|
+
Output:
|
|
102
|
+
CRITICAL: 2
|
|
103
|
+
HIGH: 4
|
|
104
|
+
MEDIUM: 7
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
### Cloud & DevOps
|
|
108
|
+
| Tool | Description |
|
|
109
|
+
|------|-------------|
|
|
110
|
+
| `aws_list_ec2_instances` | List EC2 instances in a specific AWS region |
|
|
111
|
+
| `aws_check_s3_public_access` | Audit S3 buckets for public access settings |
|
|
112
|
+
| `k8s_list_pods` | List Kubernetes pods in a given namespace |
|
|
113
|
+
| `cicd_pipeline_status` | Fetch CI/CD pipeline execution status |
|
|
114
|
+
| `git_recent_commits` | Fetch recent commit history from the active Git repo |
|
|
115
|
+
|
|
116
|
+
### Jenkins CI/CD
|
|
117
|
+
| Tool | Description |
|
|
118
|
+
|------|-------------|
|
|
119
|
+
| `jenkins_list_jobs` | List all jobs on a Jenkins server |
|
|
120
|
+
| `jenkins_get_job_info` | Get detailed info about a specific job (build history, health) |
|
|
121
|
+
| `jenkins_create_job` | Create a new Jenkins job from XML config |
|
|
122
|
+
| `jenkins_trigger_build` | Trigger a build with optional parameters (JSON) |
|
|
123
|
+
| `jenkins_get_build_info` | Get result, duration, and status of a specific build |
|
|
124
|
+
| `jenkins_get_build_log` | Fetch console output of a build |
|
|
125
|
+
| `jenkins_delete_job` | Delete a Jenkins job |
|
|
126
|
+
|
|
127
|
+
> [!TIP]
|
|
128
|
+
> **Jenkins tools require per-call credentials** — pass `url`, `username`, and `api_token` with each call. No global env vars needed.
|
|
129
|
+
|
|
130
|
+
### Application Security & SAST
|
|
131
|
+
| Tool | Description |
|
|
132
|
+
|------|-------------|
|
|
133
|
+
| `security_semgrep_scan` | Run Semgrep SAST scan on a local directory or file |
|
|
134
|
+
| `security_run_trivy_scan` | Run Trivy vulnerability scan on a container image |
|
|
135
|
+
| `security_scan_secrets` | Scan files/directories for exposed secrets |
|
|
136
|
+
| `security_check_dependencies` | Check dependency files for known CVEs via OSV.dev |
|
|
137
|
+
|
|
138
|
+
### Network & Infrastructure Security
|
|
139
|
+
| Tool | Description |
|
|
140
|
+
|------|-------------|
|
|
141
|
+
| `k8s_security_audit` | Audit Kubernetes clusters (privileged containers, wildcard RBAC, etc.) |
|
|
142
|
+
| `network_port_scan` | TCP port scan to detect exposed services |
|
|
143
|
+
| `security_check_ssl_certificate` | Validate SSL/TLS certificate details and expiry |
|
|
144
|
+
| `security_check_http_headers` | Audit URLs for security headers (HSTS, CSP, etc.) |
|
|
145
|
+
|
|
146
|
+
> [!IMPORTANT]
|
|
147
|
+
> **SAST (Semgrep scan) works only on Agent IDEs (e.g., Antigravity, Cursor) or Claude Co-work.**
|
|
148
|
+
> It does **not** work on Claude Desktop due to Windows subprocess pipe limitations with `semgrep-core.exe`. All other tools (secrets scan, SSL check, port scan, etc.) work on all platforms including Claude Desktop.
|
|
149
|
+
|
|
150
|
+
---
|
|
151
|
+
|
|
152
|
+
## 🚀 Getting Started
|
|
153
|
+
|
|
137
154
|
### Prerequisites
|
|
138
155
|
|
|
139
156
|
- **Python 3.12+**
|
|
140
157
|
- **Node.js 18+** (only if you want to run via npm/npx)
|
|
141
158
|
- **Semgrep** — `pip install semgrep` (for SAST scanning)
|
|
142
159
|
- Optional: AWS CLI / `boto3`, `kubectl`, Trivy (for their respective tools)
|
|
143
|
-
|
|
144
|
-
### Installation
|
|
145
|
-
|
|
146
|
-
```bash
|
|
147
|
-
git clone https://github.com/raghulvj01/aegis-mcp.git
|
|
148
|
-
cd aegis-mcp
|
|
149
|
-
|
|
150
|
-
# Create virtual environment
|
|
151
|
-
python -m venv .venv
|
|
152
|
-
|
|
153
|
-
# Activate it
|
|
154
|
-
# Linux/Mac:
|
|
155
|
-
source .venv/bin/activate
|
|
156
|
-
# Windows:
|
|
157
|
-
.venv\Scripts\activate
|
|
158
|
-
|
|
159
|
-
# Install dependencies
|
|
160
|
+
|
|
161
|
+
### Installation
|
|
162
|
+
|
|
163
|
+
```bash
|
|
164
|
+
git clone https://github.com/raghulvj01/aegis-mcp.git
|
|
165
|
+
cd aegis-mcp
|
|
166
|
+
|
|
167
|
+
# Create virtual environment
|
|
168
|
+
python -m venv .venv
|
|
169
|
+
|
|
170
|
+
# Activate it
|
|
171
|
+
# Linux/Mac:
|
|
172
|
+
source .venv/bin/activate
|
|
173
|
+
# Windows:
|
|
174
|
+
.venv\Scripts\activate
|
|
175
|
+
|
|
176
|
+
# Install dependencies
|
|
160
177
|
pip install -r requirements.txt
|
|
161
178
|
```
|
|
162
179
|
|
|
@@ -171,13 +188,13 @@ npx -y @raghulm/aegis-mcp
|
|
|
171
188
|
On first run, the npm wrapper creates a local Python virtual environment and installs dependencies from `requirements.txt` automatically.
|
|
172
189
|
|
|
173
190
|
---
|
|
174
|
-
|
|
175
|
-
## 🤖 Usage with AI Agents
|
|
176
|
-
|
|
177
|
-
### Agent IDE / Antigravity (Recommended)
|
|
178
|
-
|
|
179
|
-
Add to your MCP config (e.g., `mcp_config.json`):
|
|
180
|
-
|
|
191
|
+
|
|
192
|
+
## 🤖 Usage with AI Agents
|
|
193
|
+
|
|
194
|
+
### Agent IDE / Antigravity (Recommended)
|
|
195
|
+
|
|
196
|
+
Add to your MCP config (e.g., `mcp_config.json`):
|
|
197
|
+
|
|
181
198
|
```json
|
|
182
199
|
{
|
|
183
200
|
"mcpServers": {
|
|
@@ -188,15 +205,15 @@ Add to your MCP config (e.g., `mcp_config.json`):
|
|
|
188
205
|
}
|
|
189
206
|
}
|
|
190
207
|
```
|
|
191
|
-
|
|
192
|
-
> ✅ **All
|
|
193
|
-
|
|
194
|
-
### Claude Desktop
|
|
195
|
-
|
|
196
|
-
Add to `claude_desktop_config.json`:
|
|
197
|
-
- **Windows**: `%LOCALAPPDATA%\Packages\Claude_...\LocalCache\Roaming\Claude\`
|
|
198
|
-
- **Mac**: `~/Library/Application Support/Claude/`
|
|
199
|
-
|
|
208
|
+
|
|
209
|
+
> ✅ **All 19 tools work**, including Semgrep SAST and Jenkins integration.
|
|
210
|
+
|
|
211
|
+
### Claude Desktop
|
|
212
|
+
|
|
213
|
+
Add to `claude_desktop_config.json`:
|
|
214
|
+
- **Windows**: `%LOCALAPPDATA%\Packages\Claude_...\LocalCache\Roaming\Claude\`
|
|
215
|
+
- **Mac**: `~/Library/Application Support/Claude/`
|
|
216
|
+
|
|
200
217
|
```json
|
|
201
218
|
{
|
|
202
219
|
"mcpServers": {
|
|
@@ -207,102 +224,103 @@ Add to `claude_desktop_config.json`:
|
|
|
207
224
|
}
|
|
208
225
|
}
|
|
209
226
|
```
|
|
210
|
-
|
|
211
|
-
> ⚠️ **
|
|
212
|
-
|
|
213
|
-
### Cursor / Windsurf (HTTP Mode)
|
|
214
|
-
|
|
215
|
-
Start the server, then add to `.cursor/mcp.json`:
|
|
216
|
-
|
|
217
|
-
```bash
|
|
218
|
-
uvicorn server.health:app --host 0.0.0.0 --port 8000
|
|
219
|
-
```
|
|
220
|
-
|
|
221
|
-
```json
|
|
222
|
-
{
|
|
223
|
-
"mcpServers": {
|
|
224
|
-
"aegis": {
|
|
225
|
-
"url": "http://localhost:8000/mcp"
|
|
226
|
-
}
|
|
227
|
-
}
|
|
228
|
-
}
|
|
229
|
-
```
|
|
230
|
-
|
|
231
|
-
### Docker Deployment
|
|
232
|
-
|
|
233
|
-
```bash
|
|
234
|
-
docker build -t aegis-mcp .
|
|
235
|
-
docker run -p 8000:8000 aegis-mcp
|
|
236
|
-
```
|
|
237
|
-
|
|
238
|
-
---
|
|
239
|
-
|
|
240
|
-
## ⚙️ Configuration
|
|
241
|
-
|
|
242
|
-
| Variable | Description | Default |
|
|
243
|
-
|----------|-------------|---------|
|
|
244
|
-
| `MCP_AUTH_DISABLED` | Disable JWT auth (auto-set for stdio) | `false` |
|
|
245
|
-
| `MCP_SERVICE_NAME` | Name of the MCP service | `aegis` |
|
|
246
|
-
| `MCP_ENV` | Environment (`dev`, `staging`, `prod`) | `dev` |
|
|
247
|
-
| `MCP_ROLES_FILE` | Path to roles policy YAML | `policies/roles.yaml` |
|
|
248
|
-
| `MCP_SCOPES_FILE` | Path to scopes policy YAML | `policies/scope_rules.yaml` |
|
|
249
|
-
| `OIDC_ISSUER` | Expected JWT `iss` claim | *None* |
|
|
250
|
-
| `OIDC_AUDIENCE` | Expected JWT `aud` claim | *None* |
|
|
251
|
-
|
|
252
|
-
---
|
|
253
|
-
|
|
254
|
-
## 🗝 Access Control
|
|
255
|
-
|
|
256
|
-
In **HTTP mode**, every tool requires a `token` argument containing a JWT. The authorization layer checks roles and scopes defined in `policies/roles.yaml` and `policies/scope_rules.yaml`.
|
|
257
|
-
|
|
258
|
-
In **stdio mode** (local usage via `run_stdio.py`), authorization is **automatically disabled** — no token required.
|
|
259
|
-
|
|
260
|
-
### Policy Example (`policies/roles.yaml`)
|
|
261
|
-
|
|
262
|
-
```yaml
|
|
263
|
-
roles:
|
|
264
|
-
viewer:
|
|
265
|
-
- aws_list_ec2_instances
|
|
266
|
-
- k8s_list_pods
|
|
267
|
-
security:
|
|
268
|
-
- security_run_trivy_scan
|
|
269
|
-
- security_semgrep_scan
|
|
270
|
-
admin:
|
|
271
|
-
- aws_list_ec2_instances
|
|
272
|
-
- k8s_list_pods
|
|
273
|
-
- security_run_trivy_scan
|
|
274
|
-
- security_semgrep_scan
|
|
275
|
-
# ... all tools
|
|
276
|
-
```
|
|
277
|
-
|
|
278
|
-
---
|
|
279
|
-
|
|
280
|
-
## 📝 Audit Logging
|
|
281
|
-
|
|
282
|
-
The `@audit_tool_call` decorator emits structured JSON logs for every invocation:
|
|
283
|
-
|
|
284
|
-
```json
|
|
285
|
-
{
|
|
286
|
-
"timestamp": "2026-03-06T08:00:01+00:00",
|
|
287
|
-
"level": "INFO",
|
|
288
|
-
"event": "tool_call_succeeded",
|
|
289
|
-
"tool": "security_run_trivy_scan",
|
|
290
|
-
"duration_ms": 1204
|
|
291
|
-
}
|
|
292
|
-
```
|
|
293
|
-
|
|
294
|
-
---
|
|
295
|
-
|
|
296
|
-
## 🛡️ Security Best Practices
|
|
297
|
-
|
|
298
|
-
1. **Enforce JWT Signature Validation** — Update `server/auth.py` to verify RS256 JWTs using your IdP's JWKS endpoint for production.
|
|
299
|
-
2. **Least-Privilege Credentials** — Assign ReadOnly IAM / K8s roles to the server environment.
|
|
300
|
-
3. **Monitor Audit Logs** — Forward JSON logs to a SIEM. Set up anomaly detection for aggressive looping.
|
|
301
|
-
|
|
302
|
-
---
|
|
303
|
-
|
|
227
|
+
|
|
228
|
+
> ⚠️ **18 of 19 tools work.** Semgrep SAST does not work due to Windows pipe limitations.
|
|
229
|
+
|
|
230
|
+
### Cursor / Windsurf (HTTP Mode)
|
|
231
|
+
|
|
232
|
+
Start the server, then add to `.cursor/mcp.json`:
|
|
233
|
+
|
|
234
|
+
```bash
|
|
235
|
+
uvicorn server.health:app --host 0.0.0.0 --port 8000
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
```json
|
|
239
|
+
{
|
|
240
|
+
"mcpServers": {
|
|
241
|
+
"aegis": {
|
|
242
|
+
"url": "http://localhost:8000/mcp"
|
|
243
|
+
}
|
|
244
|
+
}
|
|
245
|
+
}
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
### Docker Deployment
|
|
249
|
+
|
|
250
|
+
```bash
|
|
251
|
+
docker build -t aegis-mcp .
|
|
252
|
+
docker run -p 8000:8000 aegis-mcp
|
|
253
|
+
```
|
|
254
|
+
|
|
255
|
+
---
|
|
256
|
+
|
|
257
|
+
## ⚙️ Configuration
|
|
258
|
+
|
|
259
|
+
| Variable | Description | Default |
|
|
260
|
+
|----------|-------------|---------|
|
|
261
|
+
| `MCP_AUTH_DISABLED` | Disable JWT auth (auto-set for stdio) | `false` |
|
|
262
|
+
| `MCP_SERVICE_NAME` | Name of the MCP service | `aegis` |
|
|
263
|
+
| `MCP_ENV` | Environment (`dev`, `staging`, `prod`) | `dev` |
|
|
264
|
+
| `MCP_ROLES_FILE` | Path to roles policy YAML | `policies/roles.yaml` |
|
|
265
|
+
| `MCP_SCOPES_FILE` | Path to scopes policy YAML | `policies/scope_rules.yaml` |
|
|
266
|
+
| `OIDC_ISSUER` | Expected JWT `iss` claim | *None* |
|
|
267
|
+
| `OIDC_AUDIENCE` | Expected JWT `aud` claim | *None* |
|
|
268
|
+
|
|
269
|
+
---
|
|
270
|
+
|
|
271
|
+
## 🗝 Access Control
|
|
272
|
+
|
|
273
|
+
In **HTTP mode**, every tool requires a `token` argument containing a JWT. The authorization layer checks roles and scopes defined in `policies/roles.yaml` and `policies/scope_rules.yaml`.
|
|
274
|
+
|
|
275
|
+
In **stdio mode** (local usage via `run_stdio.py`), authorization is **automatically disabled** — no token required.
|
|
276
|
+
|
|
277
|
+
### Policy Example (`policies/roles.yaml`)
|
|
278
|
+
|
|
279
|
+
```yaml
|
|
280
|
+
roles:
|
|
281
|
+
viewer:
|
|
282
|
+
- aws_list_ec2_instances
|
|
283
|
+
- k8s_list_pods
|
|
284
|
+
security:
|
|
285
|
+
- security_run_trivy_scan
|
|
286
|
+
- security_semgrep_scan
|
|
287
|
+
admin:
|
|
288
|
+
- aws_list_ec2_instances
|
|
289
|
+
- k8s_list_pods
|
|
290
|
+
- security_run_trivy_scan
|
|
291
|
+
- security_semgrep_scan
|
|
292
|
+
# ... all tools
|
|
293
|
+
```
|
|
294
|
+
|
|
295
|
+
---
|
|
296
|
+
|
|
297
|
+
## 📝 Audit Logging
|
|
298
|
+
|
|
299
|
+
The `@audit_tool_call` decorator emits structured JSON logs for every invocation:
|
|
300
|
+
|
|
301
|
+
```json
|
|
302
|
+
{
|
|
303
|
+
"timestamp": "2026-03-06T08:00:01+00:00",
|
|
304
|
+
"level": "INFO",
|
|
305
|
+
"event": "tool_call_succeeded",
|
|
306
|
+
"tool": "security_run_trivy_scan",
|
|
307
|
+
"duration_ms": 1204
|
|
308
|
+
}
|
|
309
|
+
```
|
|
310
|
+
|
|
311
|
+
---
|
|
312
|
+
|
|
313
|
+
## 🛡️ Security Best Practices
|
|
314
|
+
|
|
315
|
+
1. **Enforce JWT Signature Validation** — Update `server/auth.py` to verify RS256 JWTs using your IdP's JWKS endpoint for production.
|
|
316
|
+
2. **Least-Privilege Credentials** — Assign ReadOnly IAM / K8s roles to the server environment.
|
|
317
|
+
3. **Monitor Audit Logs** — Forward JSON logs to a SIEM. Set up anomaly detection for aggressive looping.
|
|
318
|
+
|
|
319
|
+
---
|
|
320
|
+
|
|
304
321
|
## 🛣️ Roadmap
|
|
305
322
|
|
|
323
|
+
- [x] Jenkins CI/CD integration (list, create, trigger, inspect, delete jobs) ✅
|
|
306
324
|
- [ ] Terraform security scanner
|
|
307
325
|
- [ ] IAM policy risk detection
|
|
308
326
|
- [ ] Kubernetes misconfiguration scanner (Basic `k8s_security_audit` implemented!)
|
|
@@ -311,34 +329,12 @@ The `@audit_tool_call` decorator emits structured JSON logs for every invocation
|
|
|
311
329
|
|
|
312
330
|
---
|
|
313
331
|
|
|
314
|
-
##
|
|
315
|
-
|
|
316
|
-
```bash
|
|
317
|
-
# 1) Login to npm
|
|
318
|
-
npm login
|
|
319
|
-
|
|
320
|
-
# 2) Verify package contents
|
|
321
|
-
npm run pack:check
|
|
322
|
-
|
|
323
|
-
# 3) Publish publicly
|
|
324
|
-
npm publish --access public
|
|
325
|
-
```
|
|
332
|
+
## 🤝 Contributing
|
|
326
333
|
|
|
327
|
-
|
|
334
|
+
See [CONTRIBUTING.md](./CONTRIBUTING.md) for contribution and maintainer release workflows.
|
|
328
335
|
|
|
329
336
|
---
|
|
330
337
|
|
|
331
|
-
##
|
|
332
|
-
|
|
333
|
-
|
|
334
|
-
2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
|
|
335
|
-
3. Add your tool into `tools/<domain>/`
|
|
336
|
-
4. Register it via `@mcp.tool()` in `server/main.py` with `@audit_tool_call` and auth check
|
|
337
|
-
5. Add tests in `tests/`
|
|
338
|
-
6. Open a Pull Request
|
|
339
|
-
|
|
340
|
-
---
|
|
341
|
-
|
|
342
|
-
## 📄 License
|
|
343
|
-
|
|
344
|
-
Distributed under the MIT License. See `LICENSE` for more information.
|
|
338
|
+
## 📄 License
|
|
339
|
+
|
|
340
|
+
Distributed under the MIT License. See `LICENSE` for more information.
|