@skaleagents/swarm 0.4.0 → 0.6.0

package/dist/review.js

@@ -16,14 +16,16 @@ export function architectureFindings(content, focus) {
             detail: `Checked ${content.length} characters with the ${focusValue} ruleset. Findings are pattern-based and should be validated against the running system.`,
         },
     ];
-    if (shouldInclude(focusValue, "security") && /0\.0\.0\.0(?:\/0)?/.test(content)) {
+    if (shouldInclude(focusValue, "security") &&
+        /0\.0\.0\.0(?:\/0)?/.test(content)) {
         findings.push({
             severity: "high",
             title: "Broad network exposure",
             detail: "Detected a possible wide-open CIDR or bind address. Restrict ingress to approved sources and keep public listeners behind the intended edge control.",
         });
     }
-    if (shouldInclude(focusValue, "security") && /AKIA[0-9A-Z]{16}/.test(content)) {
+    if (shouldInclude(focusValue, "security") &&
+        /AKIA[0-9A-Z]{16}/.test(content)) {
         findings.push({
             severity: "critical",
             title: "Possible AWS access key",
@@ -39,8 +41,9 @@ export function architectureFindings(content, focus) {
         });
     }
     if (shouldInclude(focusValue, "security") &&
-        /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)\s*[:=]\s*["'][^"']{8,}["']/i.test(content) &&
-        !/(?:process\.env|secrets?\.|vault|parameter|<[^>]+>|\$\{)/i.test(content)) {
+        [
+            ...content.matchAll(/(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi),
+        ].some((match) => literalCredential(match[1]))) {
         findings.push({
             severity: "high",
             title: "Hardcoded credential-like value",
@@ -64,14 +67,15 @@ export function architectureFindings(content, focus) {
         });
     }
     if (shouldInclude(focusValue, "security") &&
-        /(?:^|[\s"'])https?:\/\/(?!localhost\b|127\.0\.0\.1\b)/i.test(content)) {
+        [...content.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((match) => externalHttp(match[0]))) {
         findings.push({
             severity: "medium",
             title: "Unencrypted HTTP endpoint",
             detail: "Detected an HTTP URL outside localhost. Use HTTPS for service and dependency traffic, and verify certificate validation is enabled.",
         });
     }
-    if ((shouldInclude(focusValue, "security") || shouldInclude(focusValue, "reliability")) &&
+    if ((shouldInclude(focusValue, "security") ||
+        shouldInclude(focusValue, "reliability")) &&
         /(?:^|[\s:=])(?:[\w./-]+:)?latest(?:[\s"']|$)/im.test(content)) {
         findings.push({
             severity: "medium",
@@ -95,14 +99,74 @@ export function architectureFindings(content, focus) {
             detail: "The content enables debug mode. Disable it in production to avoid noisy behavior and accidental disclosure of internal details.",
         });
     }
-    if (shouldInclude(focusValue, "cost") && /(?:instance_type|machine_type|vm_size)\s*[:=]/i.test(content)) {
+    if (shouldInclude(focusValue, "cost") &&
+        /(?:instance_type|machine_type|vm_size)\s*[:=]/i.test(content)) {
         findings.push({
             severity: "info",
             title: "Compute sizing needs review",
             detail: "Detected an explicit compute size. Compare the selected size with observed utilization and set a review point for scale-up and scale-down decisions.",
         });
     }
-    return findings;
+    return findings.map((finding, index) => {
+        if (index === 0)
+            return finding;
+        const matchers = {
+            "Broad network exposure": /0\.0\.0\.0(?:\/0)?/,
+            "Possible AWS access key": /AKIA[0-9A-Z]{16}/,
+            "Private key material in source": /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/,
+            "Hardcoded credential-like value": /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi,
+            "Wildcard permission detected": /(?:Action|actions?)\s*[:=][^\n]*["']?\*["']?/i,
+            "Elevated container privileges": /(?:privileged|hostNetwork|allowPrivilegeEscalation)\s*:\s*true/i,
+            "Unencrypted HTTP endpoint": /\bhttp:\/\/[^\s"'<>]+/gi,
+            "Unpinned container image": /\blatest\b/,
+            "Public data access pattern": /(?:public-read|publicRead|allUsers)/i,
+            "Debug mode enabled": /(?:debug|app_debug)\s*[:=]\s*["']?(?:true|1|yes)/i,
+            "Compute sizing needs review": /(?:instance_type|machine_type|vm_size)\s*[:=]/i,
+        };
+        const pattern = matchers[finding.title];
+        const matches = pattern
+            ? [
+                ...content.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g")),
+            ]
+            : [];
+        const match = matches.find((m) => finding.title === "Hardcoded credential-like value"
+            ? literalCredential(m[1])
+            : finding.title === "Unencrypted HTTP endpoint"
+                ? externalHttp(m[0])
+                : true);
+        const offset = match?.index ?? 0;
+        const before = content.slice(0, offset);
+        const ruleIndex = Object.keys(matchers).indexOf(finding.title) + 1;
+        return {
+            ...finding,
+            ruleId: `APP${String(ruleIndex).padStart(3, "0")}`,
+            category: (finding.title === "Compute sizing needs review"
+                ? "cost"
+                : ["Debug mode enabled", "Unpinned container image"].includes(finding.title)
+                    ? "reliability"
+                    : "security"),
+            remediation: finding.detail,
+            location: {
+                line: before.split("\n").length,
+                column: offset - before.lastIndexOf("\n"),
+                path: "source",
+            },
+        };
+    });
+}
+export function literalCredential(value) {
+    return (value.trim().length > 0 &&
+        !/^(?:\$\{|\{\{|<[^>]+>$|process\.env\.|var\.|secrets?\.)/.test(value));
+}
+export function externalHttp(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === "http:" &&
+            !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
 }
 export async function fetchPublicBotHints(token) {
     try {
@@ -125,6 +189,3 @@ export async function fetchPublicBotHints(token) {
         return [];
     }
 }
-export function countIacResources(content) {
-    return (content.match(/\bresource\b|\bkind:\s*\w+/gi) ?? []).length;
-}

package/dist/server.js

@@ -1,15 +1,62 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { getApiAccessToken, requireApiAuth, unauthorizedContent, } from "./auth.js";
-import { architectureFindings, countIacResources, fetchPublicBotHints, } from "./review.js";
+import { architectureFindings, fetchPublicBotHints } from "./review.js";
+import { looksLikeIac, ScanInputError } from "./iac/parse.js";
+import { filterFindings, scanIac, summarize } from "./iac/scan.js";
+import { registerConsultation } from "./application/tools.js";
+import { VERSION } from "./version.js";
+const contentSchema = z
+    .string()
+    .min(1)
+    .max(500_000)
+    .refine((value) => value.trim().length > 0, "Content must not be whitespace");
+const filters = {
+    focus: z
+        .enum(["security", "reliability", "cost", "general"])
+        .default("general"),
+    minSeverity: z
+        .enum(["info", "low", "medium", "high", "critical"])
+        .default("info")
+        .describe("Lowest finding severity to return"),
+    maxFindings: z
+        .number()
+        .int()
+        .min(1)
+        .max(500)
+        .default(100)
+        .describe("Maximum findings returned; totals include all matching findings"),
+};
+function result(output) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
+        structuredContent: output,
+    };
+}
+function inputError(error) {
+    if (!(error instanceof ScanInputError))
+        throw error;
+    return {
+        isError: true,
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify({
+                    error: "invalid_input",
+                    message: error.message,
+                }),
+            },
+        ],
+    };
+}
 export function createServer(remote = false) {
-    const server = new McpServer({
-        name: "skaleagents-swarm",
-        version: "0.4.0",
+    const server = new McpServer({ name: "skaleagents-swarm", version: VERSION }, {
+        instructions: "For a whole application architecture consultation, start with plan_architecture_review, read relevant files with the client's workspace tools, then call review_application_architecture. Ask its follow-up questions and carry answers forward in context. Use review_architecture for individual source snippets and scan_iac for infrastructure. Ground conclusions in the returned evidence and coverage limits.",
     });
+    registerConsultation(server, remote);
     server.registerTool("review_architecture", {
         title: "Review architecture",
-        description: "Review application source or infrastructure text for security, reliability, and cost risks.",
+        description: "Review individual source snippets or parsed infrastructure for security, reliability, and cost risks. For a whole application or Next.js architecture consultation, use plan_architecture_review and review_application_architecture instead.",
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
@@ -17,16 +64,8 @@ export function createServer(remote = false) {
         },
         _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
         inputSchema: {
-            content: z
-                .string()
-                .min(1)
-                .max(500_000)
-                .describe("Application source or IaC text to review"),
-            focus: z
-                .enum(["security", "reliability", "cost", "general"])
-                .optional()
-                .default("general")
-                .describe("Review focus: security, reliability, cost, general"),
+            content: contentSchema.describe("Application source or IaC text to review"),
+            ...filters,
             format: z
                 .enum([
                 "terraform",
@@ -39,7 +78,7 @@ export function createServer(remote = false) {
                 .default("auto")
                 .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
         },
-    }, async ({ content, focus, format }) => {
+    }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         let token;
         if (!remote) {
             const auth = await requireApiAuth();
@@ -49,59 +88,70 @@ export function createServer(remote = false) {
             if (!token)
                 return unauthorizedContent({ ok: false, reason: "oauth_failed" });
         }
-        const botHints = await fetchPublicBotHints(token);
-        const focusValue = focus ?? "general";
-        const formatValue = format ?? "auto";
-        const output = {
-            summary: `Structured architecture review from @skaleagents/swarm (focus=${focusValue}, format=${formatValue})`,
-            findings: architectureFindings(content, focusValue),
-            botHints,
-        };
-        return {
-            content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
-        };
-    });
-    server.registerTool("scan_iac_stub", {
-        title: "Scan IaC (stub)",
-        description: "Stub seam for Phase 2 DevSecOps IaC scanning.",
-        annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            openWorldHint: false,
-        },
-        _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
-        inputSchema: {
-            content: z
-                .string()
-                .min(1)
-                .max(500_000)
-                .describe("Terraform / CloudFormation / Kubernetes YAML"),
-            format: z
-                .string()
-                .optional()
-                .describe("terraform, cloudformation, kubernetes, auto"),
-        },
-    }, async ({ content, format }) => {
-        if (!remote) {
-            const auth = await requireApiAuth();
-            if (!auth.ok)
-                return unauthorizedContent(auth);
+        try {
+            const options = { focus, minSeverity, maxFindings };
+            if (format !== "application" &&
+                (format !== "auto" || looksLikeIac(content))) {
+                return result({
+                    ...scanIac(content, { ...options, format }),
+                    botHints: await fetchPublicBotHints(token),
+                });
+            }
+            const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
+            return result({
+                status: "completed",
+                engineVersion: VERSION,
+                format: "application",
+                focus,
+                summary: `Application review completed; ${findings.length} findings match the selected filters.`,
+                findings: findings.slice(0, maxFindings),
+                totalFindings: findings.length,
+                totals: summarize(findings),
+                truncated: findings.length > maxFindings,
+                limitations: [
+                    "Application checks are text patterns, not a language-aware or runtime analysis. Findings do not establish that code is safe.",
+                ],
+                botHints: await fetchPublicBotHints(token),
+            });
+        }
+        catch (error) {
+            return inputError(error);
         }
-        const formatValue = format === "terraform" ||
-            format === "cloudformation" ||
-            format === "kubernetes" ||
-            format === "auto"
-            ? format
-            : "auto";
-        const output = {
-            status: "stub",
-            message: "Full IaC scanning lands in Phase 2 agent-swarm",
-            format: formatValue,
-            parsedResourceCount: countIacResources(content),
-        };
-        return {
-            content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
-        };
     });
+    for (const name of ["scan_iac", "scan_iac_stub"])
+        server.registerTool(name, {
+            title: name === "scan_iac"
+                ? "Scan infrastructure"
+                : "Scan infrastructure (compatibility alias)",
+            description: (name === "scan_iac_stub"
+                ? "Compatibility alias for scan_iac; runs the full scanner. "
+                : "") +
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes manifests. Check security, reliability and cost rules with resource locations and remediation.",
+            annotations: {
+                readOnlyHint: true,
+                destructiveHint: false,
+                openWorldHint: false,
+            },
+            _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
+            inputSchema: {
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes YAML/JSON"),
+                format: z
+                    .enum(["terraform", "cloudformation", "kubernetes", "auto"])
+                    .default("auto"),
+                ...filters,
+            },
+        }, async ({ content, format, focus, minSeverity, maxFindings }) => {
+            if (!remote) {
+                const auth = await requireApiAuth();
+                if (!auth.ok)
+                    return unauthorizedContent(auth);
+            }
+            try {
+                return result(scanIac(content, { format, focus, minSeverity, maxFindings }));
+            }
+            catch (error) {
+                return inputError(error);
+            }
+        });
     return server;
 }

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const VERSION = "0.6.0";

package/dist/version.js

@@ -0,0 +1 @@
+export const VERSION = "0.6.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -24,7 +24,7 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
-    "test": "tsx --test src/**/*.test.ts",
+    "test": "tsx --test src/*.test.ts src/iac/*.test.ts src/application/*.test.ts",
     "smoke": "tsx scripts/smoke-tools.mjs"
   },
   "engines": {
@@ -32,11 +32,13 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "hcl2-parser": "^1.0.3",
+    "typescript": "^5.9.3",
+    "yaml": "^2.9.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^22.20.1",
-    "tsx": "^4.23.12",
-    "typescript": "^5.7.3"
+    "tsx": "^4.23.12"
   }
 }