@sulthonzh/mcp-audit 1.1.0

package/dist/scanners/helm-scanner.js

@@ -0,0 +1,385 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanHelm = scanHelm;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const logger_1 = require("../utils/logger");
+// ---- Go template stripping ----
+const TEMPLATE_PATTERNS = [
+    /\{\{-?\s*\/\*[\s\S]*?\*\/\s*-?\}\}/g, // {{/* comment */}}
+    /\{\{-?\s*if\s+[\s\S]*?-?\}\}/g, // {{ if ... }}
+    /\{\{-?\s*else\s*-?\}\}/g, // {{ else }}
+    /\{\{-?\s*end\s*-?\}\}/g, // {{ end }}
+    /\{\{-?\s*range\s+[\s\S]*?-?\}\}/g, // {{ range ... }}
+    /\{\{-?\s*with\s+[\s\S]*?-?\}\}/g, // {{ with ... }}
+    /\{\{-?\s*block\s+[\s\S]*?-?\}\}/g, // {{ block ... }}
+    /\{\{-?\s*define\s+[\s\S]*?-?\}\}/g, // {{ define ... }}
+    /\{\{-?\s*tpl\s+[\s\S]*?-?\}\}/g, // {{ tpl ... }}
+    /\{\{-?\s*include\s+[\s\S]*?-?\}\}/g, // {{ include ... }}
+    /\{\{-?\s*toYaml\s+[\s\S]*?-?\}\}/g, // {{ toYaml ... }}
+    /\{\{-?\s*toJson\s+[\s\S]*?-?\}\}/g, // {{ toJson ... }}
+    /\{\{-?\s*\.[\w.]+\s*\|?\s*[\w\s]*-?\}\}/g, // {{ .Values.xxx }}
+    /\{\{-?\s*\$[\w.]+\s*-?\}\}/g, // {{ $var }}
+    /\{\{-?\s*default\s+[\s\S]*?-?\}\}/g, // {{ default ... }}
+    /\{\{-?\s*printf\s+[\s\S]*?-?\}\}/g, // {{ printf ... }}
+    /\{\{-?\s*required\s+[\s\S]*?-?\}\}/g, // {{ required ... }}
+    /\{\{-?\s*lookup\s+[\s\S]*?-?\}\}/g, // {{ lookup ... }}
+    /\{\{-?\s*\w+\s+[\s\S]*?-?\}\}/g, // {{ function args }}
+    /\{\{-?\s*[\s\S]*?-?\}\}/g, // catch-all remaining
+];
+function stripGoTemplate(content) {
+    let cleaned = content;
+    // Remove comments first
+    cleaned = cleaned.replace(/\{\{-?\s*\/\*[\s\S]*?\*\/\s*-?\}\}/g, '');
+    // Replace remaining template expressions with placeholder or empty
+    cleaned = cleaned.replace(/\{\{[\s\S]*?\}\}/g, '');
+    return cleaned;
+}
+// ---- values.yaml checks ----
+function checkValues(values, relPath) {
+    const issues = [];
+    if (!values || typeof values !== 'object')
+        return issues;
+    function walk(obj, path) {
+        if (!obj || typeof obj !== 'object')
+            return;
+        for (const [key, val] of Object.entries(obj)) {
+            const currentPath = path ? `${path}.${key}` : key;
+            const keyLower = key.toLowerCase();
+            // Hardcoded secrets
+            if ((keyLower.includes('password') || keyLower.includes('secret') ||
+                keyLower.includes('token') || keyLower.includes('apikey') ||
+                keyLower.includes('api_key') || keyLower.includes('accesskey') ||
+                keyLower.includes('access_key') || keyLower.includes('privatekey') ||
+                keyLower.includes('private_key')) &&
+                typeof val === 'string' && val.length > 0) {
+                // Skip obvious placeholders
+                const placeholders = ['changeme', 'replace', 'xxx', 'placeholder', '${', '%(', 'your-', 'REPLACE'];
+                const isPlaceholder = placeholders.some(p => val.toLowerCase().includes(p.toLowerCase()));
+                if (!isPlaceholder) {
+                    issues.push({
+                        type: 'high',
+                        category: 'config',
+                        title: 'Hardcoded secret in values.yaml',
+                        description: `Found "${currentPath}" with what appears to be a real value in values.yaml`,
+                        recommendation: 'Use .Values.secrets or external secret management (Sealed Secrets, External Secrets Operator)',
+                        evidence: `${relPath} → ${currentPath}`,
+                    });
+                }
+            }
+            // Privileged container flags in values
+            if (keyLower === 'privileged' && val === true) {
+                issues.push({
+                    type: 'high',
+                    category: 'permissions',
+                    title: 'Privileged container in values',
+                    description: `values.yaml sets privileged: true at ${currentPath}`,
+                    recommendation: 'Avoid running containers in privileged mode. Use fine-grained capabilities instead.',
+                    evidence: `${relPath} → ${currentPath}`,
+                });
+            }
+            if (keyLower === 'runasroot' && val === true) {
+                issues.push({
+                    type: 'medium',
+                    category: 'permissions',
+                    title: 'runAsRoot enabled in values',
+                    description: `values.yaml sets runAsRoot: true at ${currentPath}`,
+                    recommendation: 'Set runAsNonRoot: true and runAsUser > 0',
+                    evidence: `${relPath} → ${currentPath}`,
+                });
+            }
+            // hostNetwork in values
+            if (keyLower === 'hostnetwork' && val === true) {
+                issues.push({
+                    type: 'high',
+                    category: 'network',
+                    title: 'hostNetwork in values',
+                    description: `values.yaml enables hostNetwork at ${currentPath}`,
+                    recommendation: 'Avoid hostNetwork unless absolutely necessary',
+                    evidence: `${relPath} → ${currentPath}`,
+                });
+            }
+            // Recurse into nested objects
+            if (typeof val === 'object' && val !== null) {
+                walk(val, currentPath);
+            }
+        }
+    }
+    walk(values, '');
+    return issues;
+}
+// ---- Chart.yaml checks ----
+function checkChartYaml(chart, relPath) {
+    const issues = [];
+    if (!chart || typeof chart !== 'object')
+        return issues;
+    // Missing appVersion
+    if (!chart.appVersion) {
+        issues.push({
+            type: 'low',
+            category: 'config',
+            title: 'Missing appVersion in Chart.yaml',
+            description: 'Chart.yaml does not specify appVersion',
+            recommendation: 'Add appVersion to track which app version the chart deploys',
+            evidence: relPath,
+        });
+    }
+    // Deprecated chart
+    if (chart.deprecated) {
+        issues.push({
+            type: 'medium',
+            category: 'config',
+            title: 'Deprecated Helm chart',
+            description: `Chart "${chart.name ?? 'unnamed'}" is marked as deprecated`,
+            recommendation: 'Migrate to a maintained chart or fork and maintain your own',
+            evidence: relPath,
+        });
+    }
+    return issues;
+}
+function extractPodSpec(manifest) {
+    const kind = manifest.kind?.toLowerCase() ?? '';
+    if (kind === 'pod')
+        return manifest.spec;
+    if (['deployment', 'statefulset', 'daemonset', 'replicaset', 'job'].includes(kind)) {
+        return manifest.spec?.template?.spec ?? null;
+    }
+    return null;
+}
+function scanTemplateManifest(doc, relPath) {
+    const issues = [];
+    if (!doc || typeof doc !== 'object' || !doc.kind)
+        return issues;
+    const manifestName = doc.metadata?.name ?? 'unnamed';
+    const podSpec = extractPodSpec(doc);
+    if (podSpec) {
+        const containers = [...(podSpec.containers ?? []), ...(podSpec.initContainers ?? [])];
+        for (const ctr of containers) {
+            const cname = ctr.name ?? 'unnamed';
+            // Privileged
+            if (ctr.securityContext?.privileged) {
+                issues.push({
+                    type: 'high', category: 'permissions',
+                    title: 'Privileged container in Helm template',
+                    description: `Container "${cname}" in ${manifestName} runs privileged (template: ${relPath})`,
+                    recommendation: 'Remove securityContext.privileged or set to false',
+                    evidence: relPath,
+                });
+            }
+            // No resource limits
+            if (!ctr.resources?.limits) {
+                issues.push({
+                    type: 'medium', category: 'config',
+                    title: 'No resource limits in Helm template',
+                    description: `Container "${cname}" in ${manifestName} has no resource limits (template: ${relPath})`,
+                    recommendation: 'Set resources.limits.cpu and resources.limits.memory',
+                    evidence: relPath,
+                });
+            }
+            // :latest tag (only warn if hardcoded, template vars are fine)
+            const image = ctr.image ?? '';
+            if (typeof image === 'string' && (image.includes(':latest') || (image.includes('/') && !image.includes(':') && !image.includes('.')))) {
+                issues.push({
+                    type: 'medium', category: 'supply-chain',
+                    title: 'Latest tag in Helm template',
+                    description: `Container "${cname}" uses untagged or :latest image: ${image}`,
+                    recommendation: 'Pin image tags to specific versions',
+                    evidence: relPath,
+                });
+            }
+            // Hardcoded env secrets
+            if (Array.isArray(ctr.env)) {
+                for (const env of ctr.env) {
+                    const n = (env.name ?? '').toLowerCase();
+                    if ((n.includes('password') || n.includes('secret') || n.includes('token')) && env.value && !env.valueFrom) {
+                        issues.push({
+                            type: 'high', category: 'config',
+                            title: 'Hardcoded secret in Helm template env',
+                            description: `Container "${cname}" has "${env.name}" as plaintext in template`,
+                            recommendation: 'Reference Kubernetes Secrets instead of hardcoding values',
+                            evidence: `${relPath} → env.${env.name}`,
+                        });
+                    }
+                }
+            }
+        }
+        // hostPath volumes
+        if (Array.isArray(podSpec.volumes)) {
+            for (const vol of podSpec.volumes) {
+                if (vol.hostPath) {
+                    issues.push({
+                        type: 'high', category: 'filesystem',
+                        title: 'hostPath volume in Helm template',
+                        description: `Template ${relPath} uses hostPath "${vol.name}" → ${vol.hostPath.path}`,
+                        recommendation: 'Use PVCs or emptyDir instead of hostPath',
+                        evidence: relPath,
+                    });
+                }
+            }
+        }
+        // hostNetwork
+        if (podSpec.hostNetwork) {
+            issues.push({
+                type: 'high', category: 'network',
+                title: 'hostNetwork in Helm template',
+                description: `Template ${relPath} enables hostNetwork`,
+                recommendation: 'Only use hostNetwork when absolutely necessary',
+                evidence: relPath,
+            });
+        }
+    }
+    // Service type checks
+    if ((doc.kind ?? '').toLowerCase() === 'service' && doc.spec?.type === 'LoadBalancer') {
+        issues.push({
+            type: 'medium', category: 'network',
+            title: 'LoadBalancer service in Helm template',
+            description: `Service "${doc.metadata?.name ?? 'unnamed'}" in ${relPath} is LoadBalancer`,
+            recommendation: 'Use ClusterIP + Ingress for internal services',
+            evidence: relPath,
+        });
+    }
+    return issues;
+}
+// ---- Chart discovery ----
+async function findHelmCharts(targetPath) {
+    const charts = [];
+    if (!(await fs_extra_1.default.pathExists(targetPath)))
+        return charts;
+    const stat = await fs_extra_1.default.stat(targetPath);
+    if (stat.isFile())
+        return charts; // Charts are directories
+    async function walk(dir, depth) {
+        if (depth > 10)
+            return; // safety limit
+        const chartFile = path_1.default.join(dir, 'Chart.yaml');
+        if (await fs_extra_1.default.pathExists(chartFile)) {
+            charts.push(dir);
+            return; // don't recurse into subcharts of found charts
+        }
+        const entries = await fs_extra_1.default.readdir(dir, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'charts')
+                continue;
+            if (entry.isDirectory()) {
+                await walk(path_1.default.join(dir, entry.name), depth + 1);
+            }
+        }
+    }
+    await walk(targetPath, 0);
+    return charts;
+}
+async function findTemplateFiles(chartDir) {
+    const templatesDir = path_1.default.join(chartDir, 'templates');
+    if (!(await fs_extra_1.default.pathExists(templatesDir)))
+        return [];
+    const files = [];
+    async function walk(dir) {
+        const entries = await fs_extra_1.default.readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path_1.default.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full);
+            }
+            else {
+                const ext = path_1.default.extname(entry.name).toLowerCase();
+                if (['.yaml', '.yml'].includes(ext)) {
+                    files.push(full);
+                }
+            }
+        }
+    }
+    await walk(templatesDir);
+    return files;
+}
+// ---- Public API ----
+async function scanHelm(targetPath, options = {}) {
+    const issues = [];
+    let chartsScanned = 0;
+    let templatesScanned = 0;
+    try {
+        const charts = await findHelmCharts(targetPath);
+        if (charts.length === 0) {
+            return {
+                scanType: 'server',
+                timestamp: new Date().toISOString(),
+                target: targetPath,
+                issues: [],
+                score: 100,
+                summary: { configFilesFound: 0, highRiskIssues: 0, mediumRiskIssues: 0, lowRiskIssues: 0 },
+            };
+        }
+        for (const chartDir of charts) {
+            const chartRel = path_1.default.relative(targetPath, chartDir) || path_1.default.basename(chartDir);
+            chartsScanned++;
+            // Scan Chart.yaml
+            const chartFile = path_1.default.join(chartDir, 'Chart.yaml');
+            if (await fs_extra_1.default.pathExists(chartFile)) {
+                const chartContent = await fs_extra_1.default.readFile(chartFile, 'utf8');
+                const chart = js_yaml_1.default.load(chartContent);
+                issues.push(...checkChartYaml(chart, path_1.default.join(chartRel, 'Chart.yaml')));
+            }
+            // Scan values.yaml
+            const valuesFile = path_1.default.join(chartDir, 'values.yaml');
+            if (await fs_extra_1.default.pathExists(valuesFile)) {
+                const valuesContent = await fs_extra_1.default.readFile(valuesFile, 'utf8');
+                const values = js_yaml_1.default.load(valuesContent);
+                issues.push(...checkValues(values, path_1.default.join(chartRel, 'values.yaml')));
+            }
+            // Scan templates
+            const templateFiles = await findTemplateFiles(chartDir);
+            for (const tf of templateFiles) {
+                const content = await fs_extra_1.default.readFile(tf, 'utf8');
+                const cleaned = stripGoTemplate(content);
+                const tfRel = path_1.default.relative(targetPath, tf);
+                try {
+                    const docs = js_yaml_1.default.loadAll(cleaned);
+                    let hadManifest = false;
+                    for (const doc of docs) {
+                        if (!doc || typeof doc !== 'object' || !doc.kind)
+                            continue;
+                        hadManifest = true;
+                        issues.push(...scanTemplateManifest(doc, tfRel));
+                    }
+                    if (hadManifest)
+                        templatesScanned++;
+                }
+                catch {
+                    // Template with too much Go syntax may not parse — that's expected
+                    logger_1.logger.debug(`Could not parse template ${tfRel} after stripping Go syntax`);
+                }
+            }
+        }
+    }
+    catch (err) {
+        logger_1.logger.warn('Helm scan error:', err);
+        issues.push({
+            type: 'medium',
+            category: 'config',
+            title: 'Helm Scan Error',
+            description: `Could not complete Helm scan: ${err instanceof Error ? err.message : String(err)}`,
+            recommendation: 'Ensure chart directories are accessible and YAML is valid',
+        });
+    }
+    const high = issues.filter(i => i.type === 'high').length;
+    const medium = issues.filter(i => i.type === 'medium').length;
+    const low = issues.filter(i => i.type === 'low').length;
+    const score = Math.max(0, 100 - high * 25 - medium * 10 - low * 3);
+    return {
+        scanType: 'server',
+        timestamp: new Date().toISOString(),
+        target: targetPath,
+        issues,
+        score,
+        summary: {
+            configFilesFound: chartsScanned + templatesScanned,
+            highRiskIssues: high,
+            mediumRiskIssues: medium,
+            lowRiskIssues: low,
+        },
+    };
+}
+//# sourceMappingURL=helm-scanner.js.map

package/dist/scanners/helm-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helm-scanner.js","sourceRoot":"","sources":["../../src/scanners/helm-scanner.ts"],"names":[],"mappings":";;;;;AA4VA,4BA0FC;AAtbD,wDAA0B;AAC1B,gDAAwB;AACxB,sDAA2B;AAC3B,4CAAyC;AAiBzC,kCAAkC;AAElC,MAAM,iBAAiB,GAAG;IACxB,qCAAqC,EAAS,oBAAoB;IAClE,+BAA+B,EAAiB,eAAe;IAC/D,yBAAyB,EAAwB,aAAa;IAC9D,wBAAwB,EAAyB,YAAY;IAC7D,kCAAkC,EAAe,kBAAkB;IACnE,iCAAiC,EAAgB,iBAAiB;IAClE,kCAAkC,EAAe,kBAAkB;IACnE,mCAAmC,EAAc,mBAAmB;IACpE,gCAAgC,EAAiB,gBAAgB;IACjE,oCAAoC,EAAa,oBAAoB;IACrE,mCAAmC,EAAc,mBAAmB;IACpE,mCAAmC,EAAc,mBAAmB;IACpE,0CAA0C,EAAM,oBAAoB;IACpE,6BAA6B,EAAoB,aAAa;IAC9D,oCAAoC,EAAa,oBAAoB;IACrE,mCAAmC,EAAc,mBAAmB;IACpE,qCAAqC,EAAY,qBAAqB;IACtE,mCAAmC,EAAc,mBAAmB;IACpE,gCAAgC,EAAiB,sBAAsB;IACvE,0BAA0B,EAAwB,sBAAsB;CACzE,CAAC;AAEF,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,wBAAwB;IACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACrE,mEAAmE;IACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+BAA+B;AAE/B,SAAS,WAAW,CAAC,MAAW,EAAE,OAAe;IAC/C,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAEzD,SAAS,IAAI,CAAC,GAAQ,EAAE,IAAY;QAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAEnC,oBAAoB;YACpB,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzD,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC9D,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAClE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAClC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EACzC,CAAC;gBACD,4BAA4B;gBAC5B,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBACnG,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC1F,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,MAAM;wBACZ,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,UAAU,WAAW,uDAAuD;wBACzF,cAAc,EAAE,+FAA+F;wBAC/G,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,aAAa;oBACvB,KAAK,EAAE,gCAAgC;oBACvC,WAAW,EAAE,wCAAwC,WAAW,EAAE;oBAClE,cAAc,EAAE,qFAAqF;oBACrG,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAQ,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,aAAa;oBACvB,KAAK,EAAE,6BAA6B;oBACpC,WAAW,EAAE,uCAAuC,WAAW,EAAE;oBACjE,cAAc,EAAE,0CAA0C;oBAC1D,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,IAAI,QAAQ,KAAK,aAAa,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,SAAS;oBACnB,KAAK,EAAE,uBAAuB;oBAC9B,WAAW,EAAE,sCAAsC,WAAW,EAAE;oBAChE,cAAc,EAAE,+CAA+C;oBAC/D,QAAQ,EAAE,GAAG,OAAO,MAAM,WAAW,EAAE;iBACxC,CAAC,CAAC;YACL,CAAC;YAED,8BAA8B;YAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8BAA8B;AAE9B,SAAS,cAAc,CAAC,KAAU,EAAE,OAAe;IACjD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAEvD,qBAAqB;IACrB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,wCAAwC;YACrD,cAAc,EAAE,6DAA6D;YAC7E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,UAAU,KAAK,CAAC,IAAI,IAAI,SAAS,2BAA2B;YACzE,cAAc,EAAE,6DAA6D;YAC7E,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,SAAS,cAAc,CAAC,QAAqB;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACzC,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAQ,EAAE,OAAe;IACrD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAEhE,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC;QACtF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;YAEpC,aAAa;YACb,IAAI,GAAG,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;oBACrC,KAAK,EAAE,uCAAuC;oBAC9C,WAAW,EAAE,cAAc,KAAK,QAAQ,YAAY,+BAA+B,OAAO,GAAG;oBAC7F,cAAc,EAAE,mDAAmD;oBACnE,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;oBAClC,KAAK,EAAE,qCAAqC;oBAC5C,WAAW,EAAE,cAAc,KAAK,QAAQ,YAAY,sCAAsC,OAAO,GAAG;oBACpG,cAAc,EAAE,sDAAsD;oBACtE,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;YAED,+DAA+D;YAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtI,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc;oBACxC,KAAK,EAAE,6BAA6B;oBACpC,WAAW,EAAE,cAAc,KAAK,qCAAqC,KAAK,EAAE;oBAC5E,cAAc,EAAE,qCAAqC;oBACrD,QAAQ,EAAE,OAAO;iBAClB,CAAC,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;oBACzC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;wBAC3G,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;4BAChC,KAAK,EAAE,uCAAuC;4BAC9C,WAAW,EAAE,cAAc,KAAK,UAAU,GAAG,CAAC,IAAI,4BAA4B;4BAC9E,cAAc,EAAE,2DAA2D;4BAC3E,QAAQ,EAAE,GAAG,OAAO,UAAU,GAAG,CAAC,IAAI,EAAE;yBACzC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC;wBACV,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY;wBACpC,KAAK,EAAE,kCAAkC;wBACzC,WAAW,EAAE,YAAY,OAAO,mBAAmB,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;wBACrF,cAAc,EAAE,0CAA0C;wBAC1D,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,cAAc;QACd,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;gBACjC,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EAAE,YAAY,OAAO,sBAAsB;gBACtD,cAAc,EAAE,gDAAgD;gBAChE,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;YACnC,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EAAE,YAAY,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,QAAQ,OAAO,kBAAkB;YACzF,cAAc,EAAE,+CAA+C;YAC/D,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4BAA4B;AAE5B,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,MAAM,kBAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAEtD,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC,CAAC,yBAAyB;IAE3D,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,CAAC,eAAe;QACvC,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,MAAM,kBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,CAAC,+CAA+C;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACrG,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,MAAM,YAAY,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,MAAM,kBAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnD,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uBAAuB;AAEhB,KAAK,UAAU,QAAQ,CAAC,UAAkB,EAAE,UAA2B,EAAE;IAC9E,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,GAAG;gBACV,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;aAC3F,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,cAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChF,aAAa,EAAE,CAAC;YAEhB,kBAAkB;YAClB,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,kBAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAG,iBAAI,CAAC,IAAI,CAAC,YAAY,CAAQ,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;YAED,mBAAmB;YACnB,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,MAAM,kBAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,aAAa,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,iBAAI,CAAC,IAAI,CAAC,aAAa,CAAQ,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1E,CAAC;YAED,iBAAiB;YACjB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACxD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,cAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAE5C,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,iBAAI,CAAC,OAAO,CAAC,OAAO,CAAU,CAAC;oBAC5C,IAAI,WAAW,GAAG,KAAK,CAAC;oBACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI;4BAAE,SAAS;wBAC3D,WAAW,GAAG,IAAI,CAAC;wBACnB,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnD,CAAC;oBACD,IAAI,WAAW;wBAAE,gBAAgB,EAAE,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,eAAM,CAAC,KAAK,CAAC,4BAA4B,KAAK,4BAA4B,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,eAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAChG,cAAc,EAAE,2DAA2D;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,MAAM,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IAEnE,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,UAAU;QAClB,MAAM;QACN,KAAK;QACL,OAAO,EAAE;YACP,gBAAgB,EAAE,aAAa,GAAG,gBAAgB;YAClD,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,MAAM;YACxB,aAAa,EAAE,GAAG;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/scanners/k8s-scanner.d.ts

@@ -0,0 +1,14 @@
+import { SecurityResult } from '../types/security-result';
+/**
+ * Kubernetes manifest security scanner for MCP servers.
+ *
+ * Checks Deployments, Pods, Services, and other K8s resources for
+ * common security misconfigurations: privileged containers, missing
+ * resource limits, exposed secrets, hostPath mounts, etc.
+ */
+interface K8sScanOptions {
+    strict?: boolean;
+}
+export declare function scanK8s(targetPath: string, options?: K8sScanOptions): Promise<SecurityResult>;
+export {};
+//# sourceMappingURL=k8s-scanner.d.ts.map

package/dist/scanners/k8s-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s-scanner.d.ts","sourceRoot":"","sources":["../../src/scanners/k8s-scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAiB,MAAM,0BAA0B,CAAC;AAEzE;;;;;;GAMG;AAEH,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAmSD,wBAAsB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqDvG"}