@skaleagents/swarm 0.3.1 → 0.5.0

package/dist/review.js

@@ -16,14 +16,16 @@ export function architectureFindings(content, focus) {
             detail: `Checked ${content.length} characters with the ${focusValue} ruleset. Findings are pattern-based and should be validated against the running system.`,
         },
     ];
-    if (shouldInclude(focusValue, "security") && /0\.0\.0\.0(?:\/0)?/.test(content)) {
+    if (shouldInclude(focusValue, "security") &&
+        /0\.0\.0\.0(?:\/0)?/.test(content)) {
         findings.push({
             severity: "high",
             title: "Broad network exposure",
             detail: "Detected a possible wide-open CIDR or bind address. Restrict ingress to approved sources and keep public listeners behind the intended edge control.",
         });
     }
-    if (shouldInclude(focusValue, "security") && /AKIA[0-9A-Z]{16}/.test(content)) {
+    if (shouldInclude(focusValue, "security") &&
+        /AKIA[0-9A-Z]{16}/.test(content)) {
         findings.push({
             severity: "critical",
             title: "Possible AWS access key",
@@ -39,8 +41,9 @@ export function architectureFindings(content, focus) {
         });
     }
     if (shouldInclude(focusValue, "security") &&
-        /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*["'][^"']{8,}["']/i.test(content) &&
-        !/(?:process\.env|secrets?\.|vault|parameter|<[^>]+>|\$\{)/i.test(content)) {
+        [
+            ...content.matchAll(/(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi),
+        ].some((match) => literalCredential(match[1]))) {
         findings.push({
             severity: "high",
             title: "Hardcoded credential-like value",
@@ -64,14 +67,15 @@ export function architectureFindings(content, focus) {
         });
     }
     if (shouldInclude(focusValue, "security") &&
-        /(?:^|[\s"'])https?:\/\/(?!localhost\b|127\.0\.0\.1\b)/i.test(content)) {
+        [...content.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((match) => externalHttp(match[0]))) {
         findings.push({
             severity: "medium",
             title: "Unencrypted HTTP endpoint",
             detail: "Detected an HTTP URL outside localhost. Use HTTPS for service and dependency traffic, and verify certificate validation is enabled.",
         });
     }
-    if ((shouldInclude(focusValue, "security") || shouldInclude(focusValue, "reliability")) &&
+    if ((shouldInclude(focusValue, "security") ||
+        shouldInclude(focusValue, "reliability")) &&
         /(?:^|[\s:=])(?:[\w./-]+:)?latest(?:[\s"']|$)/im.test(content)) {
         findings.push({
             severity: "medium",
@@ -95,21 +99,82 @@ export function architectureFindings(content, focus) {
             detail: "The content enables debug mode. Disable it in production to avoid noisy behavior and accidental disclosure of internal details.",
         });
     }
-    if (shouldInclude(focusValue, "cost") && /(?:instance_type|machine_type|vm_size)\s*[:=]/i.test(content)) {
+    if (shouldInclude(focusValue, "cost") &&
+        /(?:instance_type|machine_type|vm_size)\s*[:=]/i.test(content)) {
         findings.push({
             severity: "info",
             title: "Compute sizing needs review",
             detail: "Detected an explicit compute size. Compare the selected size with observed utilization and set a review point for scale-up and scale-down decisions.",
         });
     }
-    return findings;
+    return findings.map((finding, index) => {
+        if (index === 0)
+            return finding;
+        const matchers = {
+            "Broad network exposure": /0\.0\.0\.0(?:\/0)?/,
+            "Possible AWS access key": /AKIA[0-9A-Z]{16}/,
+            "Private key material in source": /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/,
+            "Hardcoded credential-like value": /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi,
+            "Wildcard permission detected": /(?:Action|actions?)\s*[:=][^\n]*["']?\*["']?/i,
+            "Elevated container privileges": /(?:privileged|hostNetwork|allowPrivilegeEscalation)\s*:\s*true/i,
+            "Unencrypted HTTP endpoint": /\bhttp:\/\/[^\s"'<>]+/gi,
+            "Unpinned container image": /\blatest\b/,
+            "Public data access pattern": /(?:public-read|publicRead|allUsers)/i,
+            "Debug mode enabled": /(?:debug|app_debug)\s*[:=]\s*["']?(?:true|1|yes)/i,
+            "Compute sizing needs review": /(?:instance_type|machine_type|vm_size)\s*[:=]/i,
+        };
+        const pattern = matchers[finding.title];
+        const matches = pattern
+            ? [
+                ...content.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g")),
+            ]
+            : [];
+        const match = matches.find((m) => finding.title === "Hardcoded credential-like value"
+            ? literalCredential(m[1])
+            : finding.title === "Unencrypted HTTP endpoint"
+                ? externalHttp(m[0])
+                : true);
+        const offset = match?.index ?? 0;
+        const before = content.slice(0, offset);
+        const ruleIndex = Object.keys(matchers).indexOf(finding.title) + 1;
+        return {
+            ...finding,
+            ruleId: `APP${String(ruleIndex).padStart(3, "0")}`,
+            category: (finding.title === "Compute sizing needs review"
+                ? "cost"
+                : ["Debug mode enabled", "Unpinned container image"].includes(finding.title)
+                    ? "reliability"
+                    : "security"),
+            remediation: finding.detail,
+            location: {
+                line: before.split("\n").length,
+                column: offset - before.lastIndexOf("\n"),
+                path: "source",
+            },
+        };
+    });
+}
+export function literalCredential(value) {
+    return (value.trim().length > 0 &&
+        !/^(?:\$\{|\{\{|<[^>]+>$|process\.env\.|var\.|secrets?\.)/.test(value));
+}
+export function externalHttp(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "http:" &&
+            !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
 }
 export async function fetchPublicBotHints(token) {
     try {
         const res = await fetch(`${getApiUrl()}/api/bots`, {
+            signal: AbortSignal.timeout(10_000),
             headers: {
                 Accept: "application/json",
-                Authorization: `Bearer ${token}`,
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
             },
         });
         if (!res.ok)
@@ -124,6 +189,3 @@ export async function fetchPublicBotHints(token) {
         return [];
     }
 }
-export function countIacResources(content) {
-    return (content.match(/\bresource\b|\bkind:\s*\w+/gi) ?? []).length;
-}

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(remote?: boolean): McpServer;

package/dist/server.js

@@ -0,0 +1,155 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { getApiAccessToken, requireApiAuth, unauthorizedContent, } from "./auth.js";
+import { architectureFindings, fetchPublicBotHints } from "./review.js";
+import { looksLikeIac, ScanInputError } from "./iac/parse.js";
+import { filterFindings, scanIac, summarize } from "./iac/scan.js";
+const contentSchema = z
+    .string()
+    .min(1)
+    .max(500_000)
+    .refine((value) => value.trim().length > 0, "Content must not be whitespace");
+const filters = {
+    focus: z
+        .enum(["security", "reliability", "cost", "general"])
+        .default("general"),
+    minSeverity: z
+        .enum(["info", "low", "medium", "high", "critical"])
+        .default("info")
+        .describe("Lowest finding severity to return"),
+    maxFindings: z
+        .number()
+        .int()
+        .min(1)
+        .max(500)
+        .default(100)
+        .describe("Maximum findings returned; totals include all matching findings"),
+};
+function result(output) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+    };
+}
+function inputError(error) {
+    if (!(error instanceof ScanInputError))
+        throw error;
+    return {
+        isError: true,
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    error: "invalid_input",
+                    message: error.message,
+                }),
+            },
+        ],
+    };
+}
+export function createServer(remote = false) {
+    const server = new McpServer({
+        name: "skaleagents-swarm",
+        version: "0.5.0",
+    });
+    server.registerTool("review_architecture", {
+        title: "Review architecture",
+        description: "Review application source or parsed infrastructure for security, reliability, and cost risks. Returns located findings, rule IDs, remediation and coverage limits.",
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
+        inputSchema: {
+            content: contentSchema.describe("Application source or IaC text to review"),
+            ...filters,
+            format: z
+                .enum([
+                "terraform",
+                "cloudformation",
+                "kubernetes",
+                "application",
+                "auto",
+            ])
+                .optional()
+                .default("auto")
+                .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
+        },
+    }, async ({ content, focus, format, minSeverity, maxFindings }) => {
+        let token;
+        if (!remote) {
+            const auth = await requireApiAuth();
+            if (!auth.ok)
+                return unauthorizedContent(auth);
+            token = (await getApiAccessToken()) ?? undefined;
+            if (!token)
+                return unauthorizedContent({ ok: false, reason: "oauth_failed" });
+        }
+        try {
+            const options = { focus, minSeverity, maxFindings };
+            if (format !== "application" &&
+                (format !== "auto" || looksLikeIac(content))) {
+                return result({
+                    ...scanIac(content, { ...options, format }),
+                    botHints: await fetchPublicBotHints(token),
+                });
+            }
+            const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
+            return result({
+                status: "completed",
+                engineVersion: "0.5.0",
+                format: "application",
+                focus,
+                summary: `Application review completed; ${findings.length} findings match the selected filters.`,
+                findings: findings.slice(0, maxFindings),
+                totalFindings: findings.length,
+                totals: summarize(findings),
+                truncated: findings.length > maxFindings,
+                limitations: [
+                    "Application checks are text patterns, not a language-aware or runtime analysis. Findings do not establish that code is safe.",
+                ],
+                botHints: await fetchPublicBotHints(token),
+            });
+        }
+        catch (error) {
+            return inputError(error);
+        }
+    });
+    for (const name of ["scan_iac", "scan_iac_stub"])
+        server.registerTool(name, {
+            title: name === "scan_iac"
+                ? "Scan infrastructure"
+                : "Scan infrastructure (compatibility alias)",
+            description: (name === "scan_iac_stub"
+                ? "Compatibility alias for scan_iac; runs the full scanner. "
+                : "") +
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes manifests. Check security, reliability and cost rules with resource locations and remediation.",
+            annotations: {
+                readOnlyHint: true,
+                destructiveHint: false,
+                openWorldHint: false,
+            },
+            _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
+            inputSchema: {
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes YAML/JSON"),
+                format: z
+                    .enum(["terraform", "cloudformation", "kubernetes", "auto"])
+                    .default("auto"),
+                ...filters,
+            },
+        }, async ({ content, format, focus, minSeverity, maxFindings }) => {
+            if (!remote) {
+                const auth = await requireApiAuth();
+                if (!auth.ok)
+                    return unauthorizedContent(auth);
+            }
+            try {
+                return result(scanIac(content, { format, focus, minSeverity, maxFindings }));
+            }
+            catch (error) {
+                return inputError(error);
+            }
+        });
+    return server;
+}

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
-  "description": "SkaleAgents MCP server — stdio tools against the Laravel api",
+  "description": "SkaleAgents review tools with OAuth for local and hosted MCP clients",
+  "exports": {
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "import": "./dist/http.js"
+    }
+  },
   "bin": {
     "skaleagents-swarm": "dist/index.js"
   },
@@ -18,7 +24,7 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
-    "test": "tsx --test src/**/*.test.ts",
+    "test": "tsx --test src/*.test.ts src/iac/*.test.ts",
     "smoke": "tsx scripts/smoke-tools.mjs"
   },
   "engines": {
@@ -26,6 +32,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "hcl2-parser": "^1.0.3",
+    "yaml": "^2.9.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {