@skaleagents/swarm 0.6.0 → 0.6.2

package/dist/review.js

@@ -1,191 +0,0 @@
-import { getApiUrl } from "./config.js";
-function shouldInclude(focus, category) {
-    return focus === "general" || focus === category;
-}
-export function architectureFindings(content, focus) {
-    const focusValue = focus === "security" ||
-        focus === "reliability" ||
-        focus === "cost" ||
-        focus === "general"
-        ? focus
-        : "general";
-    const findings = [
-        {
-            severity: "info",
-            title: "Structured review completed",
-            detail: `Checked ${content.length} characters with the ${focusValue} ruleset. Findings are pattern-based and should be validated against the running system.`,
-        },
-    ];
-    if (shouldInclude(focusValue, "security") &&
-        /0\.0\.0\.0(?:\/0)?/.test(content)) {
-        findings.push({
-            severity: "high",
-            title: "Broad network exposure",
-            detail: "Detected a possible wide-open CIDR or bind address. Restrict ingress to approved sources and keep public listeners behind the intended edge control.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        /AKIA[0-9A-Z]{16}/.test(content)) {
-        findings.push({
-            severity: "critical",
-            title: "Possible AWS access key",
-            detail: "A value matches an AWS access-key pattern. Remove it from source, rotate the credential, and check repository history.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/.test(content)) {
-        findings.push({
-            severity: "critical",
-            title: "Private key material in source",
-            detail: "Detected a private-key block. Revoke or rotate the key, remove it from source and history, and load replacement credentials through a secret manager.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        [
-            ...content.matchAll(/(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi),
-        ].some((match) => literalCredential(match[1]))) {
-        findings.push({
-            severity: "high",
-            title: "Hardcoded credential-like value",
-            detail: "A credential-like assignment contains a literal value. Move it to a secret manager or runtime environment and rotate the exposed value.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        /(?:Action|actions?)\s*[:=][^\n]*["']?\*["']?/i.test(content)) {
-        findings.push({
-            severity: "high",
-            title: "Wildcard permission detected",
-            detail: "An IAM or policy action uses a wildcard. Replace it with the smallest permission set required by the workload.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        /(?:privileged\s*:\s*true|hostNetwork\s*:\s*true|allowPrivilegeEscalation\s*:\s*true)/i.test(content)) {
-        findings.push({
-            severity: "critical",
-            title: "Elevated container privileges",
-            detail: "The content enables a privileged container setting. Remove it unless the workload requires it, then isolate and monitor that workload.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        [...content.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((match) => externalHttp(match[0]))) {
-        findings.push({
-            severity: "medium",
-            title: "Unencrypted HTTP endpoint",
-            detail: "Detected an HTTP URL outside localhost. Use HTTPS for service and dependency traffic, and verify certificate validation is enabled.",
-        });
-    }
-    if ((shouldInclude(focusValue, "security") ||
-        shouldInclude(focusValue, "reliability")) &&
-        /(?:^|[\s:=])(?:[\w./-]+:)?latest(?:[\s"']|$)/im.test(content)) {
-        findings.push({
-            severity: "medium",
-            title: "Unpinned container image",
-            detail: "An image uses the mutable latest tag. Pin a version or digest so deployments are repeatable and rollback targets remain known.",
-        });
-    }
-    if (shouldInclude(focusValue, "security") &&
-        /(?:public-read|publicRead|allUsers)/i.test(content)) {
-        findings.push({
-            severity: "high",
-            title: "Public data access pattern",
-            detail: "Detected a public access setting. Confirm the resource is intended to be public and restrict access when it is not.",
-        });
-    }
-    if (shouldInclude(focusValue, "reliability") &&
-        /(?:debug|app_debug)\s*[:=]\s*["']?(?:true|1|yes)["']?/i.test(content)) {
-        findings.push({
-            severity: "medium",
-            title: "Debug mode enabled",
-            detail: "The content enables debug mode. Disable it in production to avoid noisy behavior and accidental disclosure of internal details.",
-        });
-    }
-    if (shouldInclude(focusValue, "cost") &&
-        /(?:instance_type|machine_type|vm_size)\s*[:=]/i.test(content)) {
-        findings.push({
-            severity: "info",
-            title: "Compute sizing needs review",
-            detail: "Detected an explicit compute size. Compare the selected size with observed utilization and set a review point for scale-up and scale-down decisions.",
-        });
-    }
-    return findings.map((finding, index) => {
-        if (index === 0)
-            return finding;
-        const matchers = {
-            "Broad network exposure": /0\.0\.0\.0(?:\/0)?/,
-            "Possible AWS access key": /AKIA[0-9A-Z]{16}/,
-            "Private key material in source": /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/,
-            "Hardcoded credential-like value": /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)["']?\s*[:=]\s*["']([^"'\n]+)["']/gi,
-            "Wildcard permission detected": /(?:Action|actions?)\s*[:=][^\n]*["']?\*["']?/i,
-            "Elevated container privileges": /(?:privileged|hostNetwork|allowPrivilegeEscalation)\s*:\s*true/i,
-            "Unencrypted HTTP endpoint": /\bhttp:\/\/[^\s"'<>]+/gi,
-            "Unpinned container image": /\blatest\b/,
-            "Public data access pattern": /(?:public-read|publicRead|allUsers)/i,
-            "Debug mode enabled": /(?:debug|app_debug)\s*[:=]\s*["']?(?:true|1|yes)/i,
-            "Compute sizing needs review": /(?:instance_type|machine_type|vm_size)\s*[:=]/i,
-        };
-        const pattern = matchers[finding.title];
-        const matches = pattern
-            ? [
-                ...content.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g")),
-            ]
-            : [];
-        const match = matches.find((m) => finding.title === "Hardcoded credential-like value"
-            ? literalCredential(m[1])
-            : finding.title === "Unencrypted HTTP endpoint"
-                ? externalHttp(m[0])
-                : true);
-        const offset = match?.index ?? 0;
-        const before = content.slice(0, offset);
-        const ruleIndex = Object.keys(matchers).indexOf(finding.title) + 1;
-        return {
-            ...finding,
-            ruleId: `APP${String(ruleIndex).padStart(3, "0")}`,
-            category: (finding.title === "Compute sizing needs review"
-                ? "cost"
-                : ["Debug mode enabled", "Unpinned container image"].includes(finding.title)
-                    ? "reliability"
-                    : "security"),
-            remediation: finding.detail,
-            location: {
-                line: before.split("\n").length,
-                column: offset - before.lastIndexOf("\n"),
-                path: "source",
-            },
-        };
-    });
-}
-export function literalCredential(value) {
-    return (value.trim().length > 0 &&
-        !/^(?:\$\{|\{\{|<[^>]+>$|process\.env\.|var\.|secrets?\.)/.test(value));
-}
-export function externalHttp(value) {
-    try {
-        const url = new URL(value);
-        return (url.protocol === "http:" &&
-            !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname));
-    }
-    catch {
-        return false;
-    }
-}
-export async function fetchPublicBotHints(token) {
-    try {
-        const res = await fetch(`${getApiUrl()}/api/bots`, {
-            signal: AbortSignal.timeout(10_000),
-            headers: {
-                Accept: "application/json",
-                ...(token ? { Authorization: `Bearer ${token}` } : {}),
-            },
-        });
-        if (!res.ok)
-            return [];
-        const data = (await res.json());
-        return data.bots
-            .filter((b) => b.status === "published" && b.visibility === "public")
-            .map((b) => b.name)
-            .slice(0, 5);
-    }
-    catch {
-        return [];
-    }
-}

package/dist/server.d.ts

@@ -1,2 +0,0 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function createServer(remote?: boolean): McpServer;

package/dist/server.js

@@ -1,157 +0,0 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z } from "zod";
-import { getApiAccessToken, requireApiAuth, unauthorizedContent, } from "./auth.js";
-import { architectureFindings, fetchPublicBotHints } from "./review.js";
-import { looksLikeIac, ScanInputError } from "./iac/parse.js";
-import { filterFindings, scanIac, summarize } from "./iac/scan.js";
-import { registerConsultation } from "./application/tools.js";
-import { VERSION } from "./version.js";
-const contentSchema = z
-    .string()
-    .min(1)
-    .max(500_000)
-    .refine((value) => value.trim().length > 0, "Content must not be whitespace");
-const filters = {
-    focus: z
-        .enum(["security", "reliability", "cost", "general"])
-        .default("general"),
-    minSeverity: z
-        .enum(["info", "low", "medium", "high", "critical"])
-        .default("info")
-        .describe("Lowest finding severity to return"),
-    maxFindings: z
-        .number()
-        .int()
-        .min(1)
-        .max(500)
-        .default(100)
-        .describe("Maximum findings returned; totals include all matching findings"),
-};
-function result(output) {
-    return {
-        content: [{ type: "text", text: JSON.stringify(output, null, 2) }],
-        structuredContent: output,
-    };
-}
-function inputError(error) {
-    if (!(error instanceof ScanInputError))
-        throw error;
-    return {
-        isError: true,
-        content: [
-            {
-                type: "text",
-                text: JSON.stringify({
-                    error: "invalid_input",
-                    message: error.message,
-                }),
-            },
-        ],
-    };
-}
-export function createServer(remote = false) {
-    const server = new McpServer({ name: "skaleagents-swarm", version: VERSION }, {
-        instructions: "For a whole application architecture consultation, start with plan_architecture_review, read relevant files with the client's workspace tools, then call review_application_architecture. Ask its follow-up questions and carry answers forward in context. Use review_architecture for individual source snippets and scan_iac for infrastructure. Ground conclusions in the returned evidence and coverage limits.",
-    });
-    registerConsultation(server, remote);
-    server.registerTool("review_architecture", {
-        title: "Review architecture",
-        description: "Review individual source snippets or parsed infrastructure for security, reliability, and cost risks. For a whole application or Next.js architecture consultation, use plan_architecture_review and review_application_architecture instead.",
-        annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            openWorldHint: false,
-        },
-        _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
-        inputSchema: {
-            content: contentSchema.describe("Application source or IaC text to review"),
-            ...filters,
-            format: z
-                .enum([
-                "terraform",
-                "cloudformation",
-                "kubernetes",
-                "application",
-                "auto",
-            ])
-                .optional()
-                .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
-        },
-    }, async ({ content, focus, format, minSeverity, maxFindings }) => {
-        let token;
-        if (!remote) {
-            const auth = await requireApiAuth();
-            if (!auth.ok)
-                return unauthorizedContent(auth);
-            token = (await getApiAccessToken()) ?? undefined;
-            if (!token)
-                return unauthorizedContent({ ok: false, reason: "oauth_failed" });
-        }
-        try {
-            const options = { focus, minSeverity, maxFindings };
-            if (format !== "application" &&
-                (format !== "auto" || looksLikeIac(content))) {
-                return result({
-                    ...scanIac(content, { ...options, format }),
-                    botHints: await fetchPublicBotHints(token),
-                });
-            }
-            const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
-            return result({
-                status: "completed",
-                engineVersion: VERSION,
-                format: "application",
-                focus,
-                summary: `Application review completed; ${findings.length} findings match the selected filters.`,
-                findings: findings.slice(0, maxFindings),
-                totalFindings: findings.length,
-                totals: summarize(findings),
-                truncated: findings.length > maxFindings,
-                limitations: [
-                    "Application checks are text patterns, not a language-aware or runtime analysis. Findings do not establish that code is safe.",
-                ],
-                botHints: await fetchPublicBotHints(token),
-            });
-        }
-        catch (error) {
-            return inputError(error);
-        }
-    });
-    for (const name of ["scan_iac", "scan_iac_stub"])
-        server.registerTool(name, {
-            title: name === "scan_iac"
-                ? "Scan infrastructure"
-                : "Scan infrastructure (compatibility alias)",
-            description: (name === "scan_iac_stub"
-                ? "Compatibility alias for scan_iac; runs the full scanner. "
-                : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes manifests. Check security, reliability and cost rules with resource locations and remediation.",
-            annotations: {
-                readOnlyHint: true,
-                destructiveHint: false,
-                openWorldHint: false,
-            },
-            _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
-            inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes YAML/JSON"),
-                format: z
-                    .enum(["terraform", "cloudformation", "kubernetes", "auto"])
-                    .default("auto"),
-                ...filters,
-            },
-        }, async ({ content, format, focus, minSeverity, maxFindings }) => {
-            if (!remote) {
-                const auth = await requireApiAuth();
-                if (!auth.ok)
-                    return unauthorizedContent(auth);
-            }
-            try {
-                return result(scanIac(content, { format, focus, minSeverity, maxFindings }));
-            }
-            catch (error) {
-                return inputError(error);
-            }
-        });
-    return server;
-}

package/dist/version.d.ts

@@ -1 +0,0 @@
-export declare const VERSION = "0.6.0";

package/dist/version.js

@@ -1 +0,0 @@
-export const VERSION = "0.6.0";