@securecode-ai/mcp 0.5.5 → 0.5.7

package/README.md

@@ -8,6 +8,12 @@ Standalone MCP (Model Context Protocol) server for SecureCode AI. Provides secur
 npm install -g @securecode-ai/mcp
 ```
 
+Or use directly with npx (no install needed):
+
+```bash
+npx @securecode-ai/mcp scan src/app.ts
+```
+
 ## Quick Start
 
 ```bash
@@ -61,6 +67,22 @@ securecode-mcp scan src/app.ts --json
 
 ### Cursor / Windsurf
 
+```json
+{
+  "mcpServers": {
+    "securecode": {
+      "command": "npx",
+      "args": ["-y", "@securecode-ai/mcp@latest", "serve", "--workspace", "/path/to/your/project"],
+      "env": {
+        "SECURECODE_API_TOKEN": "your-api-token-here"
+      }
+    }
+  }
+}
+```
+
+Or if installed globally:
+
 ```json
 {
   "mcpServers": {
@@ -78,14 +100,14 @@ securecode-mcp scan src/app.ts --json
 claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/your/project
 ```
 
-## Tools (11)
+## Tools (16)
 
 ### Scanning
 
 | Tool | Description | Approval |
 |------|-------------|----------|
 | `securecode.scan` | Scan code for vulnerabilities (AI pipeline) | No |
-| `securecode.agent-scan` | Agent-mode deep scan with 10 tools + sandbox proof | No |
+| `securecode.agent-scan` | Agent-mode deep scan with 20+ tools, structured proof, and sandbox verification | No |
 | `securecode.scan-batch` | Scan multiple files in one call | No |
 | `securecode.scan-secrets` | Scan for hardcoded secrets and PII (local, no AI) | No |
 | `securecode.scan-dependencies` | Scan lockfiles for known vulnerabilities (OSV/NVD) | No |
@@ -94,7 +116,7 @@ claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/y
 
 | Tool | Description | Approval |
 |------|-------------|----------|
-| `securecode.map` | Get the Project Map (endpoints, middleware, auth) | No |
+| `securecode.map` | Build project map: endpoints, middleware, auth, architecture context | No |
 
 ### Fixes & Testing
 
@@ -102,6 +124,7 @@ claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/y
 |------|-------------|----------|
 | `securecode.fix` | Generate a patch for a specific finding | Yes |
 | `securecode.attack` | Endpoint red-team testing (beta) | Yes |
+| `securecode.run-tests` | Run tests in sandbox for verification | Yes |
 
 ### Agent Memory (FP Learning)
 
@@ -112,6 +135,14 @@ claude mcp add securecode -s user -- securecode-mcp serve --workspace /path/to/y
 | `securecode.clear-agent-memory` | Clear all agent memory (or one FP by ID) | No |
 | `securecode.add-known-fact` | Add a project fact for faster investigations | No |
 
+### Finding Review
+
+| Tool | Description | Approval |
+|------|-------------|----------|
+| `securecode.review-findings` | Review the finding queue for a workspace | No |
+| `securecode.decide-finding` | Accept or reject a finding in the review queue | No |
+| `securecode.clear-finding-reviews` | Clear all finding reviews for a workspace | No |
+
 ### How Agent Memory Works
 
 When the agent reports a false positive, dismiss it with `record-false-positive`. The agent stores the pattern in `.securecode/agent-memory.json` and will not report similar patterns in future scans of that workspace.
@@ -125,17 +156,25 @@ Memory is per-workspace, user-owned, and deletable. No cross-tenant leakage.
 
 ## Agent Scan Architecture
 
-The agent scan (`securecode.agent-scan`) is an AI investigator that:
+The agent scan (`securecode.agent-scan`) is an AI security investigator that:
+
+1. **Maps** the project architecture (architecture scout with trust boundaries, security controls, risks)
+2. **Reads** the target file and related files across the codebase
+3. **Traces** data flows (taint tracking, cross-file flow with structured source→sink→hop chains)
+4. **Checks** guards, endpoint policies, and configuration
+5. **Verifies** threat model applicability and capability reachability
+6. **Self-critiques** before reporting (selfCritique field)
+7. **Gets reviewed** by an independent critique LLM
+8. **Proves** findings in a sandbox (PROVEN/UNPROVEN)
+9. **Generates fixes** for proven findings
 
-1. **Reads** the target file and related files (10 tools)
-2. **Traces** data flows (taint tracking, cross-file)
-3. **Checks** guards and endpoint policies
-4. **Self-critiques** before reporting (selfCritique field)
-5. **Gets reviewed** by an independent critique LLM
-6. **Proves** findings in a sandbox (PROVEN/UNPROVEN)
-7. **Generates fixes** for proven findings
+Agent tools (20+): `read_file`, `search_code`, `trace_flow`, `trace_flow_cross_file`, `check_guard`, `check_policy`, `get_endpoints`, `list_imports`, `list_files`, `call_graph`, `git_blame`, `git_history`, `git_diff`, `check_dependencies`, `read_config`, `find_definition`, `find_references`, `find_tests`, `run_tests`, `finish`.
 
-Agent tools: `read_file`, `search_code`, `trace_flow`, `trace_flow_cross_file`, `check_guard`, `check_policy`, `get_endpoints`, `list_imports`, `list_files`, `finish`.
+The deterministic control plane enforces proof quality:
+- Every finding requires source, reachability, control, threat-model, and impact evidence
+- Unproven concerns become investigation notes, not findings
+- Architecture risks expand across related files (callers, implementations, sinks)
+- The finish gate rejects finish while proof requirements remain unsatisfied
 
 Languages: JavaScript, TypeScript, Python (partial).
 
@@ -145,6 +184,7 @@ Languages: JavaScript, TypeScript, Python (partial).
 |----------|---------|-------------|
 | `SECURECODE_API_TOKEN` | — | API token (alternative to login) |
 | `SECURECODE_API_URL` | `https://api.usesecurecode.tech` | API base URL |
+| `SECURECODE_ATTACK_ENABLED` | — | Set to `1` to enable the attack tool |
 
 ## Security
 

package/dist/api/types.d.ts

@@ -184,18 +184,25 @@ export interface SandboxProveResponse {
         exploitStatus?: number;
     };
     scanCredits?: number;
+    proofEvidence?: import('../attack/proofTypes').ProofEvidence;
+    proofGateResult?: import('../attack/proofTypes').ProofGateResult;
 }
 export interface VerifyGenerateResponse {
     canTest: boolean;
     testScript?: string;
+    setupScript?: string | null;
     runner?: string;
     description?: string;
     skipReason?: string;
     scanCredits?: number;
+    /** Dollar cost the API charged for this generate call (credits → USD). */
+    costUsd?: number;
 }
 export interface VerifyAnalyzeResponse {
     verdict: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE';
     reason: string;
     shouldRetry: boolean;
     scanCredits?: number;
+    /** Dollar cost the API charged for this analyze call (credits → USD). */
+    costUsd?: number;
 }

package/dist/approval/auditLog.d.ts

@@ -1,3 +1,3 @@
 import type { AuditEntry } from './types';
-export declare function appendAudit(entry: AuditEntry): void;
+export declare function appendAudit(entry: AuditEntry): boolean;
 export declare function readAudit(limit?: number): AuditEntry[];

package/dist/approval/auditLog.js

@@ -40,6 +40,8 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const AUDIT_DIR = path.join(os.homedir(), '.securecode');
 const AUDIT_FILE = path.join(AUDIT_DIR, 'approval-audit.log');
+const MAX_ENTRIES = 200;
+let auditWriteFailed = false;
 function appendAudit(entry) {
     try {
         if (!fs.existsSync(AUDIT_DIR)) {
@@ -47,12 +49,18 @@ function appendAudit(entry) {
         }
         const line = JSON.stringify(entry) + '\n';
         fs.appendFileSync(AUDIT_FILE, line, { mode: 0o600 });
+        auditWriteFailed = false;
+        return true;
     }
-    catch {
-        // best effort — audit failure must not block the operation
+    catch (err) {
+        if (!auditWriteFailed) {
+            auditWriteFailed = true;
+            console.warn(`[securecode] Audit write failed: ${err?.message || err}. Further audit failures will be silent.`);
+        }
+        return false;
     }
 }
-function readAudit(limit = 100) {
+function readAudit(limit = MAX_ENTRIES) {
     try {
         if (!fs.existsSync(AUDIT_FILE))
             return [];

package/dist/approval/auditLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/approval/auditLog.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,kCAUC;AAED,8BASC;AA7BD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAGzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAE9D,SAAgB,WAAW,CAAC,KAAiB;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACL,2DAA2D;IAC/D,CAAC;AACL,CAAC;AAED,SAAgB,SAAS,CAAC,QAAgB,GAAG;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}
+{"version":3,"file":"auditLog.js","sourceRoot":"","sources":["../../src/approval/auditLog.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,kCAgBC;AAED,8BASC;AAtCD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AAGzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAC9D,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,SAAgB,WAAW,CAAC,KAAiB;IACzC,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,gBAAgB,GAAG,KAAK,CAAC;QACzB,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAChB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,EAAE,OAAO,IAAI,GAAG,0CAA0C,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAgB,SAAS,CAAC,QAAgB,WAAW;IACjD,IAAI,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC"}

package/dist/approval/broker.d.ts

@@ -1,4 +1,4 @@
-import { type ApprovalResult } from './types';
+import { type ApprovalResult, type OperationCategory } from './types';
 export declare class ApprovalBroker {
     private server;
     private port;
@@ -6,6 +6,11 @@ export declare class ApprovalBroker {
     start(): Promise<number>;
     stop(): Promise<void>;
     getPort(): number;
-    requestApproval(tool: string, summary: string, operationParts: unknown[], timeoutMs?: number): Promise<ApprovalResult>;
+    requestApproval(tool: string, summary: string, operationParts: unknown[], timeoutMs?: number, category?: OperationCategory, workspaceRoot?: string | null): Promise<ApprovalResult>;
+    private settle;
+    private isLocalOrigin;
+    private isLocalHost;
     private handle;
+    private handleDetails;
+    private handleDecide;
 }

package/dist/approval/broker.js

@@ -38,6 +38,9 @@ const http = __importStar(require("http"));
 const child_process_1 = require("child_process");
 const types_1 = require("./types");
 const auditLog_1 = require("./auditLog");
+const MAX_PENDING = 16;
+const MAX_BODY_BYTES = 4096;
+const LOOPBACK = '127.0.0.1';
 const APPROVAL_PAGE_HTML = `<!DOCTYPE html>
 <html>
 <head>
@@ -55,6 +58,7 @@ button { padding: 10px 24px; border: none; border-radius: 6px; font-size: 14px;
 .result { margin-top: 24px; font-size: 16px; font-weight: 600; }
 .timeout { color: #d97706; }
 .expired { display: none; color: #dc2626; }
+.error { color: #dc2626; }
 </style>
 </head>
 <body>
@@ -70,42 +74,65 @@ button { padding: 10px 24px; border: none; border-radius: 6px; font-size: 14px;
 <script>
 const params = new URLSearchParams(window.location.search);
 const reqId = params.get('id');
-document.getElementById('tool').textContent = params.get('tool') || '';
-document.getElementById('hash').textContent = params.get('hash') || '';
-document.getElementById('summary').textContent = decodeURIComponent(params.get('summary') || '');
+let decisionToken = '';
 
-async function respond(approved) {
-document.getElementById('buttons').style.display = 'none';
-const res = document.getElementById('result');
-try {
-const r = await fetch('/decide', {
-method: 'POST',
-headers: {'Content-Type': 'application/json'},
-body: JSON.stringify({ id: reqId, approved })
-});
-const data = await r.json();
-if (data.ok) {
-res.textContent = approved ? 'Approved. You can close this page.' : 'Denied. You can close this page.';
-res.style.color = approved ? '#16a34a' : '#dc2626';
-} else {
-res.textContent = 'Error: ' + (data.error || 'unknown');
-res.style.color = '#dc2626';
-}
-} catch (e) {
-res.textContent = 'Error: ' + e.message;
-res.style.color = '#dc2626';
-}
+async function loadDetails() {
+    try {
+        const r = await fetch('/details?id=' + encodeURIComponent(reqId || ''));
+        const data = await r.json();
+        if (!data.ok) {
+            document.getElementById('buttons').style.display = 'none';
+            const el = document.getElementById('result');
+            el.textContent = 'Error: ' + (data.error || 'unknown');
+            el.style.color = '#dc2626';
+            return;
+        }
+        document.getElementById('tool').textContent = data.tool || '';
+        document.getElementById('hash').textContent = data.operationHash || '';
+        document.getElementById('summary').textContent = data.summary || '';
+        decisionToken = data.decisionToken || '';
+        if (data.expiresAt && Date.now() > data.expiresAt) {
+            document.getElementById('buttons').style.display = 'none';
+            document.getElementById('expired').style.display = 'block';
+        }
+    } catch (e) {
+        document.getElementById('buttons').style.display = 'none';
+        const el = document.getElementById('result');
+        el.textContent = 'Error loading details: ' + e.message;
+        el.style.color = '#dc2626';
+    }
 }
 
-const expiresAt = parseInt(params.get('exp') || '0');
-if (expiresAt && Date.now() > expiresAt) {
-document.getElementById('buttons').style.display = 'none';
-document.getElementById('expired').style.display = 'block';
+async function respond(approved) {
+    document.getElementById('buttons').style.display = 'none';
+    const res = document.getElementById('result');
+    try {
+        const r = await fetch('/decide', {
+            method: 'POST',
+            headers: {'Content-Type': 'application/json'},
+            body: JSON.stringify({ id: reqId, decisionToken, approved })
+        });
+        const data = await r.json();
+        if (data.ok) {
+            res.textContent = approved ? 'Approved. You can close this page.' : 'Denied. You can close this page.';
+            res.style.color = approved ? '#16a34a' : '#dc2626';
+        } else {
+            res.textContent = 'Error: ' + (data.error || 'unknown');
+            res.style.color = '#dc2626';
+        }
+    } catch (e) {
+        res.textContent = 'Error: ' + e.message;
+        res.style.color = '#dc2626';
+    }
 }
+
+loadDetails();
 </script>
 </body>
 </html>`;
 function openBrowser(url) {
+    if (process.env.SECURECODE_TEST_MODE === '1')
+        return;
     const platform = process.platform;
     try {
         if (platform === 'darwin') {
@@ -122,14 +149,23 @@ function openBrowser(url) {
         // If browser open fails, the user can copy the URL from stdout
     }
 }
+const SECURITY_HEADERS = {
+    'Content-Security-Policy': "default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; connect-src 'self'",
+    'X-Content-Type-Options': 'nosniff',
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+};
 class ApprovalBroker {
     server = null;
     port = 0;
     pending = new Map();
     async start() {
-        return new Promise((resolve) => {
+        return new Promise((resolve, reject) => {
             this.server = http.createServer((req, res) => this.handle(req, res));
-            this.server.listen(0, '127.0.0.1', () => {
+            this.server.once('error', (err) => {
+                reject(err);
+            });
+            this.server.listen(0, LOOPBACK, () => {
                 const addr = this.server.address();
                 this.port = addr.port;
                 resolve(this.port);
@@ -137,6 +173,9 @@ class ApprovalBroker {
         });
     }
     async stop() {
+        for (const [, entry] of this.pending) {
+            this.settle(entry, false, 'shutdown', 'Broker shutting down');
+        }
         return new Promise((resolve) => {
             if (this.server) {
                 this.server.close(() => resolve());
@@ -149,104 +188,194 @@ class ApprovalBroker {
     getPort() {
         return this.port;
     }
-    requestApproval(tool, summary, operationParts, timeoutMs = 60_000) {
+    requestApproval(tool, summary, operationParts, timeoutMs = 60_000, category = 'paid-generation', workspaceRoot = null) {
         return new Promise((resolve) => {
-            const req = (0, types_1.createApprovalRequest)(tool, summary, operationParts, timeoutMs);
-            const startTime = Date.now();
-            this.pending.set(req.id, { req, resolve });
-            const url = `http://127.0.0.1:${this.port}/?id=${req.id}&tool=${encodeURIComponent(tool)}&hash=${req.operationHash}&summary=${encodeURIComponent(summary)}&exp=${req.expiresAt}`;
-            console.error(`[securecode] Approval required for ${tool}. Open: ${url}`);
-            openBrowser(url);
+            if (this.pending.size >= MAX_PENDING) {
+                resolve({
+                    approved: false,
+                    reason: 'Too many pending approval requests',
+                    requestId: '',
+                    duration: 0,
+                    category,
+                });
+                return;
+            }
+            const req = (0, types_1.createApprovalRequest)(tool, summary, operationParts, timeoutMs, category, workspaceRoot);
+            const startTime = req.createdAt;
             const timer = setTimeout(() => {
                 const entry = this.pending.get(req.id);
-                if (entry) {
-                    this.pending.delete(req.id);
-                    const result = {
-                        approved: false,
-                        reason: 'Request timed out',
-                        requestId: req.id,
-                        duration: Date.now() - startTime,
-                    };
-                    (0, auditLog_1.appendAudit)({
-                        timestamp: new Date().toISOString(),
-                        requestId: req.id,
-                        tool: req.tool,
-                        operationHash: req.operationHash,
-                        approved: false,
-                        reason: 'timeout',
-                        durationMs: result.duration,
-                    });
-                    resolve(result);
+                if (entry && !entry.settled) {
+                    this.settle(entry, false, 'timeout', 'Request timed out');
                 }
             }, timeoutMs + 5000);
-            const origResolve = resolve;
-            this.pending.set(req.id, {
-                req,
-                resolve: (r) => {
-                    clearTimeout(timer);
-                    origResolve(r);
-                },
-            });
+            const entry = { req, resolve, timer, settled: false };
+            this.pending.set(req.id, entry);
+            const url = `http://${LOOPBACK}:${this.port}/?id=${req.id}`;
+            console.error(`[securecode] Approval required for ${tool}. Open: ${url}`);
+            openBrowser(url);
         });
     }
+    settle(entry, approved, reason, humanReason) {
+        if (entry.settled)
+            return;
+        entry.settled = true;
+        clearTimeout(entry.timer);
+        this.pending.delete(entry.req.id);
+        const duration = Date.now() - entry.req.createdAt;
+        const result = {
+            approved,
+            reason: humanReason,
+            requestId: entry.req.id,
+            duration,
+            category: entry.req.category,
+        };
+        const audit = {
+            timestamp: new Date().toISOString(),
+            requestId: entry.req.id,
+            tool: entry.req.tool,
+            operationHash: entry.req.operationHash,
+            category: entry.req.category,
+            workspaceId: entry.req.workspaceId,
+            approved,
+            reason,
+            durationMs: duration,
+        };
+        (0, auditLog_1.appendAudit)(audit);
+        entry.resolve(result);
+    }
+    isLocalOrigin(req) {
+        const origin = req.headers.origin;
+        if (!origin)
+            return true; // non-browser client
+        try {
+            const u = new URL(origin);
+            return u.hostname === LOOPBACK;
+        }
+        catch {
+            return false;
+        }
+    }
+    isLocalHost(req) {
+        const host = req.headers.host || '';
+        try {
+            const { hostname } = new URL(`http://${host}`);
+            return hostname === LOOPBACK || hostname === 'localhost';
+        }
+        catch {
+            return false;
+        }
+    }
     handle(req, res) {
+        if (!this.isLocalHost(req)) {
+            res.writeHead(403, SECURITY_HEADERS);
+            res.end('Forbidden');
+            return;
+        }
         const url = req.url || '/';
         if (req.method === 'GET' && (url === '/' || url.startsWith('/?'))) {
-            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.writeHead(200, { 'Content-Type': 'text/html', ...SECURITY_HEADERS });
             res.end(APPROVAL_PAGE_HTML);
             return;
         }
+        if (req.method === 'GET' && url.startsWith('/details')) {
+            this.handleDetails(req, res);
+            return;
+        }
         if (req.method === 'POST' && req.url === '/decide') {
-            let body = '';
-            req.on('data', (c) => { body += c; });
-            req.on('end', () => {
-                try {
-                    const data = JSON.parse(body);
-                    const requestId = data.id;
-                    const entry = requestId ? this.pending.get(requestId) : undefined;
-                    if (!entry || !requestId) {
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
-                        return;
-                    }
-                    if ((0, types_1.isExpired)(entry.req)) {
-                        this.pending.delete(requestId);
-                        res.writeHead(200, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
-                        return;
-                    }
-                    this.pending.delete(requestId);
-                    const approved = data.approved === true;
-                    const startTime = entry.req.createdAt;
-                    const result = {
-                        approved,
-                        reason: approved ? 'User approved' : 'User denied',
-                        requestId: entry.req.id,
-                        duration: Date.now() - startTime,
-                    };
-                    (0, auditLog_1.appendAudit)({
-                        timestamp: new Date().toISOString(),
-                        requestId: entry.req.id,
-                        tool: entry.req.tool,
-                        operationHash: entry.req.operationHash,
-                        approved,
-                        reason: approved ? 'approved' : 'denied',
-                        durationMs: result.duration,
-                    });
-                    entry.resolve(result);
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: true }));
-                }
-                catch {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ ok: false, error: 'Invalid request body' }));
-                }
-            });
+            this.handleDecide(req, res);
             return;
         }
-        res.writeHead(404);
+        res.writeHead(404, SECURITY_HEADERS);
         res.end('Not found');
     }
+    handleDetails(req, res) {
+        const parsed = new URL(req.url || '', `http://${LOOPBACK}`);
+        const id = parsed.searchParams.get('id');
+        const entry = id ? this.pending.get(id) : undefined;
+        if (!entry || !id) {
+            res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
+            return;
+        }
+        if ((0, types_1.isExpired)(entry.req)) {
+            res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+        res.end(JSON.stringify({
+            ok: true,
+            tool: entry.req.tool,
+            summary: entry.req.summary,
+            operationHash: entry.req.operationHash,
+            expiresAt: entry.req.expiresAt,
+            decisionToken: entry.req.decisionToken,
+        }));
+    }
+    handleDecide(req, res) {
+        if (!this.isLocalOrigin(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Forbidden origin' }));
+            return;
+        }
+        const ct = req.headers['content-type'] || '';
+        if (!ct.includes('application/json')) {
+            res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+            res.end(JSON.stringify({ ok: false, error: 'Content-Type must be application/json' }));
+            return;
+        }
+        let body = '';
+        let tooLarge = false;
+        req.on('data', (c) => {
+            body += c;
+            if (body.length > MAX_BODY_BYTES) {
+                tooLarge = true;
+                req.destroy();
+            }
+        });
+        req.on('end', () => {
+            if (tooLarge) {
+                res.writeHead(413, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: false, error: 'Body too large' }));
+                return;
+            }
+            try {
+                const data = JSON.parse(body);
+                const requestId = data.id;
+                const entry = requestId ? this.pending.get(requestId) : undefined;
+                if (!entry || !requestId) {
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request not found or already answered' }));
+                    return;
+                }
+                if (entry.settled) {
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request already answered' }));
+                    return;
+                }
+                if (!data.decisionToken || data.decisionToken !== entry.req.decisionToken) {
+                    this.settle(entry, false, 'invalid-token', 'Invalid decision token');
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Invalid decision token' }));
+                    return;
+                }
+                if ((0, types_1.isExpired)(entry.req)) {
+                    this.settle(entry, false, 'expired', 'Request expired');
+                    res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                    res.end(JSON.stringify({ ok: false, error: 'Request expired' }));
+                    return;
+                }
+                const approved = data.approved === true;
+                this.settle(entry, approved, approved ? 'approved' : 'denied', approved ? 'User approved' : 'User denied');
+                res.writeHead(200, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: true }));
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'application/json', ...SECURITY_HEADERS });
+                res.end(JSON.stringify({ ok: false, error: 'Invalid request body' }));
+            }
+        });
+    }
 }
 exports.ApprovalBroker = ApprovalBroker;
 //# sourceMappingURL=broker.js.map