@secureai-sdk/sdk 1.2.1 → 1.2.3

package/src/bin/cli.ts

@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+
+/**
+ * SecureAI CLI for Node.js / NPM (`npx -y @secureai-sdk/sdk <command>`)
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import { inspectInput } from "../guard";
+import { defaultVault } from "../vault";
+import { startMCPProxy } from "../mcp-proxy";
+
+const HOME = os.homedir();
+const CWD = process.cwd();
+
+const args = process.argv.slice(2);
+const command = args[0] || "help";
+
+function getApiKey(): string {
+  const envKey = process.env.SECUREAI_API_KEY;
+  if (envKey && (envKey.startsWith("sec_live_") || envKey.startsWith("sec_test_"))) {
+    return envKey;
+  }
+  const configPath = path.join(HOME, ".secureai", "config.json");
+  if (fs.existsSync(configPath)) {
+    try {
+      const cfg = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+      if (cfg.api_key) return cfg.api_key;
+    } catch {}
+  }
+  return "";
+}
+
+function requireAuth(allowLocal: boolean = true): string {
+  const key = getApiKey();
+  if (!key) {
+    if (allowLocal) {
+      return "sec_test_local_eval";
+    }
+    console.error("\n❌ [SecureAI Authentication Required - Zero Unauthorized Access]");
+    console.error("Error: No valid API key found. SecureAI strictly prohibits unauthorized access.");
+    console.error("Set: export SECUREAI_API_KEY=\"sec_live_...\"\n");
+    process.exit(1);
+  }
+  return key;
+}
+
+switch (command) {
+  case "version": {
+    console.log("SecureAI Node.js SDK v1.2.3 — https://secure.acadmyai.com");
+    break;
+  }
+
+  case "scan": {
+    requireAuth(true);
+    const prompt = args[1] || "";
+    const res = inspectInput(prompt);
+    console.log("\n🛡️  SecureAI Heuristic Fast-Path Scanner (Node.js)");
+    console.log("==================================================");
+    console.log(`Status:          ${res.isSafe ? "PASSED" : "BLOCKED"}`);
+    console.log(`Risk Score:      ${res.riskScore} / 1.0`);
+    console.log(`Threat Detected: ${res.threatDetected || "None"}`);
+    console.log(`Latency:         ${res.latencyMs} ms\n`);
+    process.exit(res.isSafe ? 0 : 1);
+  }
+
+  case "vault": {
+    requireAuth(true);
+    const text = args[1] || "";
+    const vaulted = defaultVault.tokenize(text);
+    console.log(`\n🔐 Vaulted Output (${vaulted.redactedCount} entities redacted):`);
+    console.log(vaulted.sanitizedText);
+    console.log("\nToken Map:", JSON.stringify(vaulted.tokenMap, null, 2));
+    break;
+  }
+
+  case "protect": {
+    requireAuth(true);
+    const isStatus = args.includes("--status");
+    const all = args.includes("--all");
+    const agentIdx = args.indexOf("--agent");
+    const targetAgent = agentIdx !== -1 && args[agentIdx + 1] ? args[agentIdx + 1] : all ? "all" : "all";
+
+    console.log(`\n🔒 Installing SecureAI Protection for: ${targetAgent}`);
+    console.log("=======================================================");
+
+    // 1. Claude Code
+    if (targetAgent === "all" || targetAgent === "claude-code") {
+      const claudeDir = path.join(HOME, ".claude");
+      fs.mkdirSync(claudeDir, { recursive: true });
+      const settingsPath = path.join(claudeDir, "settings.json");
+      let data: any = {};
+      if (fs.existsSync(settingsPath)) {
+        try { data = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); } catch {}
+      }
+      data.hooks = data.hooks || {};
+      data.hooks.PreToolUse = data.hooks.PreToolUse || [];
+      const cmd = "secureai intercept-tool --agent claude-code";
+      if (!data.hooks.PreToolUse.some((h: any) => h.command === cmd)) {
+        data.hooks.PreToolUse.push({ command: cmd, description: "SecureAI Zero-Trust Agent Action Firewall" });
+        fs.writeFileSync(settingsPath, JSON.stringify(data, null, 2));
+      }
+      console.log(`  • claude-code: [INSTALLED] via PreToolUse -> ${settingsPath}`);
+    }
+
+    // 2. Cursor
+    if (targetAgent === "all" || targetAgent === "cursor") {
+      const cursorDir = path.join(CWD, ".cursor");
+      fs.mkdirSync(cursorDir, { recursive: true });
+      const settingsPath = path.join(cursorDir, "settings.json");
+      let data: any = {};
+      if (fs.existsSync(settingsPath)) {
+        try { data = JSON.parse(fs.readFileSync(settingsPath, "utf-8")); } catch {}
+      }
+      data["ai.agent.preToolHook"] = "secureai intercept-tool --agent cursor";
+      fs.writeFileSync(settingsPath, JSON.stringify(data, null, 2));
+      console.log(`  • cursor: [INSTALLED] via preToolHook -> ${settingsPath}`);
+    }
+
+    // 3. Antigravity
+    if (targetAgent === "all" || targetAgent === "antigravity") {
+      const agentsDir = path.join(CWD, ".agents");
+      fs.mkdirSync(agentsDir, { recursive: true });
+      const hooksPath = path.join(agentsDir, "hooks.json");
+      let data: any = { hooks: [] };
+      if (fs.existsSync(hooksPath)) {
+        try { data = JSON.parse(fs.readFileSync(hooksPath, "utf-8")); } catch {}
+      }
+      data.hooks = data.hooks || [];
+      const cmd = "secureai intercept-tool --agent antigravity --json";
+      if (!data.hooks.some((h: any) => h.command === cmd)) {
+        data.hooks.push({ event: "PreToolUse", command: cmd, provider: "SecureAI" });
+        fs.writeFileSync(hooksPath, JSON.stringify(data, null, 2));
+      }
+      console.log(`  • antigravity: [INSTALLED] via AGY-Customization -> ${hooksPath}`);
+    }
+
+    // 4. Kiro
+    if (targetAgent === "all" || targetAgent === "kiro") {
+      const kiroDir = path.join(HOME, ".kiro", "hooks");
+      fs.mkdirSync(kiroDir, { recursive: true });
+      const hookPath = path.join(kiroDir, "secureai-guard.json");
+      const config = {
+        trigger: "PreToolUse",
+        action: {
+          type: "shell",
+          command: "secureai intercept-tool --agent kiro"
+        },
+        enabled: true,
+        version: "1.0.0"
+      };
+      fs.writeFileSync(hookPath, JSON.stringify(config, null, 2));
+      console.log(`  • kiro: [INSTALLED] via PreToolUse -> ${hookPath}`);
+    }
+
+    // 5. VS Code
+    if (targetAgent === "all" || targetAgent === "vscode") {
+      const vscodeDir = path.join(CWD, ".vscode");
+      fs.mkdirSync(vscodeDir, { recursive: true });
+      const mcpPath = path.join(vscodeDir, "mcp.json");
+      let data: any = { mcpServers: {} };
+      if (fs.existsSync(mcpPath)) {
+        try { data = JSON.parse(fs.readFileSync(mcpPath, "utf-8")); } catch {}
+      }
+      data.mcpServers = data.mcpServers || {};
+      data.mcpServers.secureai = {
+        command: "secureai",
+        args: ["serve-mcp"]
+      };
+      fs.writeFileSync(mcpPath, JSON.stringify(data, null, 2));
+      console.log(`  • vscode: [INSTALLED] via MCP-Server -> ${mcpPath}`);
+    }
+
+    console.log("\n✅ AI IDEs are now governed by SecureAI Action Firewall.\n");
+    break;
+  }
+
+  case "mcp-wrap": {
+    requireAuth();
+    const sepIndex = args.indexOf("--");
+    if (sepIndex === -1 || sepIndex >= args.length - 1) {
+      console.error("Error: Specify upstream command after '--'. Example: npx -y @secureai-sdk/sdk mcp-wrap -- npx -y @modelcontextprotocol/server-postgres postgresql://...");
+      process.exit(1);
+    }
+    const targetCommand = args[sepIndex + 1];
+    const targetArgs = args.slice(sepIndex + 2);
+    startMCPProxy({ targetCommand, targetArgs });
+    break;
+  }
+
+  default: {
+    console.log(`
+SecureAI CLI — Enterprise AI Security, Guardrails & Agent Firewall
+Usage:
+  secureai scan <prompt>          Scan prompt for injection & PII
+  secureai vault <text>           Tokenize sensitive entities
+  secureai protect --all          Install PreToolUse hooks on all AI IDEs
+  secureai protect --agent <name> Install hook for specific agent (claude-code, cursor, antigravity)
+  secureai mcp-wrap -- <cmd...>   Wrap upstream MCP server in Zero-Trust sidecar
+  secureai version                Show SDK version
+`);
+    break;
+  }
+}

package/src/client.ts

@@ -5,7 +5,16 @@ import {
   ModelScanResult,
   ServicesConfig,
   SecureAIClientOptions,
-  UserSecurityContext
+  UserSecurityContext,
+  RedTeamSimulateResult,
+  CanaryTokenResult,
+  CanaryVerificationResult,
+  McpAuthResult,
+  AibomResult,
+  RagContextResult,
+  GroundingResult,
+  CacheStatsResult,
+  AspmPostureResult
 } from "./types";
 
 export class SecureAI {
@@ -38,7 +47,7 @@ export class SecureAI {
         headers: {
           "Authorization": `Bearer ${this.apiKey}`,
           "Content-Type": "application/json",
-          "User-Agent": "@secureai-sdk/sdk-node/1.2.1",
+          "User-Agent": "@secureai-sdk/sdk-node/1.2.3",
           ...(options.headers || {})
         }
       });
@@ -69,7 +78,7 @@ export class SecureAI {
   }
 
   /**
-   * Inspects prompt for injections, jailbreaks, and toxicity.
+   * Inspects prompt for injections, jailbreaks, and toxicity in sub-0.5ms.
    */
   public async inspect(prompt: string, context?: UserSecurityContext): Promise<PromptInspectionResult> {
     return this.request<PromptInspectionResult>("/guard/inspect", {
@@ -106,6 +115,31 @@ export class SecureAI {
     });
   }
 
+  /**
+   * Convenience alias for LangGraph and prompt inspection.
+   */
+  public async inspectPrompt(prompt: string, context?: UserSecurityContext): Promise<PromptInspectionResult> {
+    return this.inspect(prompt, context);
+  }
+
+  /**
+   * Convenience alias for CrewAI and agent tool call interceptors.
+   */
+  public async interceptTool(options: {
+    botId?: string;
+    toolName: string;
+    arguments?: Record<string, any>;
+    context?: UserSecurityContext;
+  }): Promise<AgentActionVerdict> {
+    return this.interceptAgentAction(
+      "EXECUTE_SHELL",
+      options.toolName,
+      JSON.stringify(options.arguments || {}),
+      options.context
+    );
+  }
+
+
   /**
    * Scans serialized ML model weights (.pkl, .pt, .onnx) for remote code execution opcodes.
    */
@@ -120,7 +154,7 @@ export class SecureAI {
   }
 
   /**
-   * Tokenizes PII into synthetic surrogate tokens.
+   * Tokenizes PII into AES-256 synthetic surrogate tokens upstream.
    */
   public async tokenizePII(text: string): Promise<PIIVaultResult> {
     const res = await this.request<{ sanitized_text: string; redacted_count: number; token_map: Record<string, string> }>(
@@ -138,7 +172,7 @@ export class SecureAI {
   }
 
   /**
-   * Detokenizes synthetic surrogate tokens back to original values.
+   * Detokenizes synthetic surrogate tokens back to original values for authorized executions.
    */
   public async detokenizePII(text: string, tokenMap: Record<string, string>): Promise<string> {
     const res = await this.request<{ detokenized_text: string }>("/vault/detokenize", {
@@ -148,6 +182,154 @@ export class SecureAI {
     return res.detokenized_text;
   }
 
+  /**
+   * Runs automated adversarial Red Teaming penetration suite across OWASP LLM Top 10.
+   */
+  public async runRedTeamSimulation(customPayload?: string): Promise<RedTeamSimulateResult> {
+    return this.request<RedTeamSimulateResult>("/redteam/simulate", {
+      method: "POST",
+      body: JSON.stringify({ custom_payload: customPayload })
+    });
+  }
+
+  /**
+   * Generates a cryptographically signed canary honeytoken trap.
+   */
+  public async generateCanaryToken(contextLabel: string = "system_prompt"): Promise<CanaryTokenResult> {
+    return this.request<CanaryTokenResult>("/canary/generate", {
+      method: "POST",
+      body: JSON.stringify({ context_label: contextLabel })
+    });
+  }
+
+  /**
+   * Verifies whether output text contains leaked canary honeytokens.
+   */
+  public async verifyCanaryLeakage(text: string): Promise<CanaryVerificationResult> {
+    return this.request<CanaryVerificationResult>("/canary/verify", {
+      method: "POST",
+      body: JSON.stringify({ text })
+    });
+  }
+
+  /**
+   * Authorizes Model Context Protocol (MCP) tool execution with AST parameter sanitization.
+   */
+  public async authorizeMcpTool(
+    serverName: string,
+    toolName: string,
+    parameters: Record<string, any>,
+    clearanceLevel: number = 1
+  ): Promise<McpAuthResult> {
+    return this.request<McpAuthResult>("/agents/mcp/proxy", {
+      method: "POST",
+      body: JSON.stringify({
+        server_name: serverName,
+        tool_name: toolName,
+        parameters,
+        caller_clearance: clearanceLevel
+      })
+    });
+  }
+
+  /**
+   * Generates CycloneDX 1.6 & SPDX 3.0 AI Bill of Materials (AIBOM).
+   */
+  public async generateAibom(
+    modelName: string,
+    modelVersion: string = "1.0.0",
+    weightsHash?: string
+  ): Promise<AibomResult> {
+    return this.request<AibomResult>("/scanner/aibom/generate", {
+      method: "POST",
+      body: JSON.stringify({
+        model_name: modelName,
+        model_version: modelVersion,
+        weights_hash: weightsHash
+      })
+    });
+  }
+
+  /**
+   * Sanitizes retrieved RAG vector database chunks from invisible Unicode steganography.
+   */
+  public async inspectRagContext(chunks: string[], sourceIds?: string[]): Promise<RagContextResult> {
+    return this.request<RagContextResult>("/rag/inspect-context", {
+      method: "POST",
+      body: JSON.stringify({ chunks, source_ids: sourceIds })
+    });
+  }
+
+  /**
+   * Sanitizes a single RAG text chunk.
+   */
+  public async sanitizeRagText(text: string): Promise<string> {
+    const res = await this.request<{ sanitized_text: string }>("/rag/sanitize", {
+      method: "POST",
+      body: JSON.stringify({ text })
+    });
+    return res.sanitized_text;
+  }
+
+  /**
+   * Verifies proposition grounding and hallucination metrics on local CPU.
+   */
+  public async verifyGrounding(claim: string, context: string): Promise<GroundingResult> {
+    return this.request<GroundingResult>("/guard/grounding", {
+      method: "POST",
+      body: JSON.stringify({ claim, context })
+    });
+  }
+
+  /**
+   * Retrieves Semantic Prompt Cache metrics and cost savings.
+   */
+  public async getCacheStats(): Promise<CacheStatsResult> {
+    return this.request<CacheStatsResult>("/cache/stats", {
+      method: "GET"
+    });
+  }
+
+  /**
+   * Retrieves live Zero-Day Threat Intelligence feed.
+   */
+  public async getThreatFeed(): Promise<any> {
+    return this.request<any>("/intel/threat-feed", {
+      method: "GET"
+    });
+  }
+
+  /**
+   * Hot-reloads custom regex threat rule into active defense without service restarts.
+   */
+  public async addCustomThreatRule(rule: {
+    name: string;
+    patternRegex: string;
+    severity?: string;
+    category?: string;
+    description?: string;
+  }): Promise<any> {
+    return this.request<any>("/intel/custom-rule", {
+      method: "POST",
+      body: JSON.stringify({
+        name: rule.name,
+        pattern_regex: rule.patternRegex,
+        severity: rule.severity || "HIGH",
+        category: rule.category || "PROMPT_INJECTION",
+        description: rule.description || ""
+      })
+    });
+  }
+
+  /**
+   * Retrieves real-time AI Security Posture Management (ASPM) score and compliance matrix.
+   */
+  public async getAspmPosture(): Promise<AspmPostureResult> {
+    return this.request<AspmPostureResult>("/aspm/posture", {
+      method: "GET"
+    });
+  }
+
   /**
    * Retrieves current Service Capability & Capacity Configuration (SCCM).
    */

package/src/grok-bot.ts

@@ -126,4 +126,32 @@ export class GrokBotGuard {
       latencyMs
     };
   }
+
+  /**
+   * Complete 3-Stage Lifecycle Protector for GrokBot and Social Agents.
+   */
+  public async protectInteraction(options: {
+    mentionText: string;
+    userId?: string;
+    executeLLM?: (sanitized: string) => Promise<string>;
+  }): Promise<{ allow: boolean; safeText: string; sanitizedResponse: string }> {
+    const ingress = this.sanitizeMention(options.mentionText);
+    if (!ingress.isSafe) {
+      return { allow: false, safeText: ingress.sanitizedText, sanitizedResponse: "Query blocked due to policy violation." };
+    }
+    let responseText = "";
+    if (options.executeLLM) {
+      responseText = await options.executeLLM(ingress.sanitizedText);
+    }
+    const egress = this.sanitizeEgress(responseText);
+    return {
+      allow: true,
+      safeText: ingress.sanitizedText,
+      sanitizedResponse: egress.sanitizedText
+    };
+  }
 }
+
+export const GrokBotMiddleware = GrokBotGuard;
+export type GrokBotMiddleware = GrokBotGuard;
+

package/src/guard.ts

@@ -117,3 +117,6 @@ export function inspectInput(prompt: string, threshold = 0.65): PromptInspection
     latencyMs: elapsedMs
   };
 }
+
+export const inspectPromptLocal = inspectInput;
+

package/src/types.ts

@@ -116,9 +116,105 @@ export interface ServicesConfig {
   [key: string]: ServiceConfigItem | undefined;
 }
 
+export interface RedTeamTestCaseResult {
+  id: string;
+  category: string;
+  prompt_payload: string;
+  why_tested: string;
+  is_blocked_by_guard: boolean;
+  status: string;
+  risk_score: number;
+  detection_rule: string;
+  mitigation_summary: string;
+  latency_ms: number;
+  scenario_type?: string;
+  adversarial_impact?: string;
+  remediation_suggestion?: string;
+}
+
+export interface RedTeamSimulateResult {
+  total_tests: number;
+  passed_tests: number;
+  failed_tests: number;
+  blocked_threats: number;
+  security_score_percent: number;
+  posture_rating: string;
+  target_tested: string;
+  test_results: RedTeamTestCaseResult[];
+  owasp_coverage: Record<string, string>;
+  timestamp: number;
+}
+
+export interface CanaryTokenResult {
+  token: string;
+  canary_id: string;
+  context_label: string;
+  created_at: number;
+}
+
+export interface CanaryVerificationResult {
+  leaked: boolean;
+  canary_tokens_found: string[];
+  alert_triggered: boolean;
+  severity: string;
+}
+
+export interface McpAuthResult {
+  allowed: boolean;
+  action: SecurityAction;
+  risk_score: number;
+  threats_detected: string[];
+  sanitized_parameters?: Record<string, any>;
+  explanation?: string;
+  requires_hitl?: boolean;
+}
+
+export interface AibomResult {
+  aibom_id: string;
+  model_name: string;
+  format: string;
+  spec_version: string;
+  generated_at: number;
+  bom_json: Record<string, any>;
+  compliance_verdict: string;
+}
+
+export interface RagContextResult {
+  is_safe: boolean;
+  sanitized_chunks: string[];
+  stego_threats_found: number;
+  latency_ms: number;
+}
+
+export interface GroundingResult {
+  is_grounded: boolean;
+  entailment_score: number;
+  confidence: number;
+  latency_ms: number;
+  unsupported_propositions: string[];
+}
+
+export interface CacheStatsResult {
+  total_requests: number;
+  cache_hits: number;
+  cache_misses: number;
+  cost_saved_usd: number;
+  avg_latency_ms: number;
+}
+
+export interface AspmPostureResult {
+  posture_score: number;
+  grade: string;
+  total_assets: number;
+  active_threats: number;
+  compliance_ratings: Record<string, string>;
+  last_updated: number;
+}
+
 export interface SecureAIClientOptions {
   apiKey?: string;
   baseUrl?: string;
   timeoutMs?: number;
   services?: ServicesConfig;
 }
+

package/src/vault.ts

@@ -45,3 +45,7 @@ export class PIIVault {
 }
 
 export const defaultVault = new PIIVault();
+
+export const tokenizePII = (text: string) => defaultVault.tokenize(text);
+export const detokenizePII = (text: string, tokenMap: Record<string, string>) => defaultVault.detokenize(text, tokenMap);
+