@venos-inc/venos 0.1.3 → 0.1.5

package/etc/mcp-server/skill-spector.js

@@ -0,0 +1,104 @@
+// SkillSpector scanner integration.
+// Runs the `skillspector` CLI as a subprocess and returns a structured summary
+// of skill-security findings. Requires skillspector to be in PATH.
+// Static analysis runs by default; pass useLlm to opt into the LLM stage.
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"];
+function emptySummary(target, installed, errorMessage) {
+    return {
+        target,
+        skillName: "",
+        riskScore: 0,
+        riskSeverity: "",
+        recommendation: "",
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        total: 0,
+        topFindings: [],
+        skillspectorInstalled: installed,
+        ...(errorMessage ? { errorMessage } : {}),
+    };
+}
+// summarize maps SkillSpector's JSON report to the tool's stable summary shape.
+// Pure function so it can be unit-tested without the scanner installed.
+export function summarize(raw, target) {
+    const counts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, UNKNOWN: 0 };
+    const issues = raw.issues ?? [];
+    for (const issue of issues) {
+        const sev = (issue.severity ?? "UNKNOWN").toUpperCase();
+        if (sev in counts)
+            counts[sev]++;
+        else
+            counts.UNKNOWN++;
+    }
+    const sorted = [...issues].sort((a, b) => SEVERITY_ORDER.indexOf((a.severity ?? "UNKNOWN").toUpperCase()) -
+        SEVERITY_ORDER.indexOf((b.severity ?? "UNKNOWN").toUpperCase()));
+    return {
+        target,
+        skillName: raw.skill?.name ?? "",
+        riskScore: raw.risk_assessment?.score ?? 0,
+        riskSeverity: raw.risk_assessment?.severity ?? "",
+        recommendation: raw.risk_assessment?.recommendation ?? "",
+        critical: counts.CRITICAL,
+        high: counts.HIGH,
+        medium: counts.MEDIUM,
+        low: counts.LOW,
+        total: issues.length,
+        topFindings: sorted.slice(0, 10).map((issue) => ({
+            id: issue.id ?? "",
+            category: issue.category ?? "",
+            severity: issue.severity ?? "UNKNOWN",
+            file: issue.location?.file ?? "",
+            startLine: issue.location?.start_line ?? null,
+            finding: issue.finding ?? "",
+            explanation: issue.explanation ?? "",
+            remediation: issue.remediation ?? "",
+        })),
+        skillspectorInstalled: true,
+    };
+}
+// isSkillspectorAvailable returns true if the scanner CLI is reachable.
+export async function isSkillspectorAvailable() {
+    try {
+        await execFileAsync("skillspector", ["--version"], { timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// scanSkill runs `skillspector scan` on a local path and returns a summary.
+export async function scanSkill(path, useLlm = false) {
+    if (!(await isSkillspectorAvailable())) {
+        return emptySummary(path, false, "skillspector is not installed. Install the venos skillspector CLI and re-run.");
+    }
+    const args = ["scan", path, "--format", "json", ...(useLlm ? [] : ["--no-llm"])];
+    let stdout;
+    try {
+        ({ stdout } = await execFileAsync("skillspector", args, {
+            timeout: 180_000,
+            maxBuffer: 50 * 1024 * 1024,
+        }));
+    }
+    catch (err) {
+        const e = err;
+        // skillspector exits non-zero when risk is high — stdout still holds JSON.
+        stdout = e.stdout ?? "";
+        if (!stdout) {
+            return emptySummary(path, true, `skillspector failed: ${e.message ?? "unknown error"}`);
+        }
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return emptySummary(path, true, "Failed to parse skillspector JSON output.");
+    }
+    return summarize(parsed, path);
+}
+//# sourceMappingURL=skill-spector.js.map

package/etc/mcp-server/tools.js

@@ -1,6 +1,7 @@
 // MCP tool definitions and handlers for the venos MCP server.
 import { z } from "zod";
 import { scanPath, scanImage } from "./trivy.js";
+import { scanSkill } from "./skill-spector.js";
 // Render the control scorecard as markdown. Pure (no I/O) so it is unit-tested
 // directly. An optional classFilter narrows the table to one class; the summary
 // counts always reflect the full registry.
@@ -24,6 +25,44 @@ export function formatControls(data, classFilter) {
     lines.push(`| Class | Control | Category | Enforced by |`, `|-------|---------|----------|-------------|`, ...rows.map((ctrl) => `| ${ctrl.class} | ${ctrl.name} | ${ctrl.category} | ${ctrl.enforcedBy} |`));
     return lines.join("\n");
 }
+// Render the Claude Code usage rollup as markdown. Pure (no I/O) so it is
+// unit-tested directly. Renders an empty-state line when no usage has been
+// reported yet rather than an empty table.
+export function formatClaudeUsage(u) {
+    const t = u.totals;
+    if (t.sessionCount === 0 && u.byModel.length === 0) {
+        return [
+            `## Venos Claude Code usage (last ${u.sinceHours}h)`,
+            ``,
+            `No Claude Code usage reported yet. Run \`venos usage-sync\` on a device with ~/.claude transcripts to populate this.`,
+        ].join("\n");
+    }
+    const totalCost = u.byModel.reduce((sum, m) => sum + m.costUsd, 0);
+    const lines = [
+        `## Venos Claude Code usage (last ${u.sinceHours}h)`,
+        ``,
+        `- **Sessions**: ${t.sessionCount.toLocaleString()}`,
+        `- **Models**: ${t.modelCount.toLocaleString()}`,
+        `- **Messages**: ${t.messageCount.toLocaleString()}`,
+        `- **Tokens in / out**: ${t.tokensIn.toLocaleString()} / ${t.tokensOut.toLocaleString()}`,
+        `- **Cache read / write**: ${t.cacheReadTokens.toLocaleString()} / ${t.cacheWriteTokens.toLocaleString()}`,
+        `- **Total cost**: $${totalCost.toFixed(4)}`,
+        ``,
+        `### By model`,
+        `| Model | Tokens in | Tokens out | Cache read | Cache write | Cost (USD) |`,
+        `|-------|-----------|------------|------------|-------------|-----------|`,
+        ...u.byModel.map((m) => `| ${m.model} | ${m.tokensIn.toLocaleString()} | ${m.tokensOut.toLocaleString()} | ${m.cacheReadTokens.toLocaleString()} | ${m.cacheWriteTokens.toLocaleString()} | $${m.costUsd.toFixed(4)} |`),
+    ];
+    const section = (title, rows) => {
+        if (rows.length === 0)
+            return;
+        lines.push(``, `### ${title}`, `| Name | Invocations |`, `|------|-------------|`, ...rows.map((r) => `| ${r.name} | ${r.invocationCount.toLocaleString()} |`));
+    };
+    section("Skills", u.skills);
+    section("Subagents", u.subagents);
+    section("MCP servers", u.mcpServers);
+    return lines.join("\n");
+}
 // Render a budget cell as "used / ceiling" — or "used / -" when no ceiling is
 // set on that dimension. Pure so it is unit-tested directly.
 function budgetCell(used, ceiling, fixed = 0) {
@@ -167,6 +206,22 @@ export function formatClosedLoop(loop) {
         lines.push(`- **Reason**: ${loop.terminationReason}`);
     return lines.join("\n");
 }
+// Render internal-knowledge search hits as a plain-ASCII markdown table. Pure
+// (no I/O) so it is unit-tested directly. A single newline replaces newlines in
+// chunk text so each hit stays on one table row. No emoji or pictographic
+// glyphs (security/compliance product convention).
+export function formatKnowledgeHits(query, hits) {
+    const lines = [`## Internal knowledge: "${query}"`, ``];
+    if (hits.length === 0) {
+        lines.push(`No matching knowledge found.`);
+        return lines.join("\n");
+    }
+    lines.push(`| Source | Chunk | Similarity | Text |`, `|--------|-------|------------|------|`, ...hits.map((h) => {
+        const text = h.chunkText.replace(/\s*\n+\s*/g, " ").trim();
+        return `| ${h.sourceId} | ${h.chunkIndex} | ${h.similarity.toFixed(2)} | ${text} |`;
+    }));
+    return lines.join("\n");
+}
 export function registerTools(server, client) {
     // ── Trivy: scan a local filesystem path ─────────────────────────────────
     server.tool("trivy_scan_path", "Scan a local directory or file for vulnerabilities using Trivy. Returns a summary of CVEs grouped by severity.", {
@@ -213,6 +268,57 @@ export function registerTools(server, client) {
         }
         return { content: [{ type: "text", text: lines.join("\n") }] };
     });
+    // ── SkillSpector: scan an agent skill for security findings ──────────────
+    server.tool("venos_scan_skill", "Scan an agent skill or plugin directory for security findings (prompt injection, data exfiltration, supply-chain, excessive agency) using SkillSpector. Returns a risk verdict and the top findings.", {
+        path: z.string().describe("Path to the skill directory or SKILL.md (e.g. ~/.claude/skills/my-skill)"),
+        useLlm: z
+            .boolean()
+            .optional()
+            .describe("Opt into the slower LLM semantic stage. Defaults to static-only analysis."),
+    }, async ({ path, useLlm }) => {
+        const result = await scanSkill(path, useLlm ?? false);
+        if (!result.skillspectorInstalled) {
+            return { content: [{ type: "text", text: `Error: ${result.errorMessage}` }], isError: true };
+        }
+        if (result.errorMessage) {
+            return {
+                content: [{ type: "text", text: `Error scanning ${path}: ${result.errorMessage}` }],
+                isError: true,
+            };
+        }
+        const lines = [
+            `## Skill scan: \`${result.skillName || result.target}\``,
+            ``,
+            `| Risk | Value |`,
+            `|------|-------|`,
+            `| Score | ${result.riskScore}/100 |`,
+            `| Severity | ${result.riskSeverity || "n/a"} |`,
+            `| Recommendation | ${result.recommendation || "n/a"} |`,
+            ``,
+            `| Severity | Count |`,
+            `|----------|-------|`,
+            `| Critical | ${result.critical} |`,
+            `| High     | ${result.high} |`,
+            `| Medium   | ${result.medium} |`,
+            `| Low      | ${result.low} |`,
+            `| **Total**   | **${result.total}** |`,
+            ``,
+        ];
+        if (result.topFindings.length > 0) {
+            lines.push(`### Top findings`);
+            for (const f of result.topFindings) {
+                const loc = f.file ? ` in \`${f.file}${f.startLine ? `:${f.startLine}` : ""}\`` : "";
+                lines.push(`- **${f.id}** (${f.severity}) ${f.category}${loc} — ${f.finding}`);
+            }
+        }
+        else {
+            lines.push("No security findings detected.");
+        }
+        return {
+            content: [{ type: "text", text: lines.join("\n") }],
+            isError: result.recommendation === "DO_NOT_INSTALL",
+        };
+    });
     // ── Trivy: scan a container image ────────────────────────────────────────
     server.tool("trivy_scan_image", "Scan a container image for OS and library vulnerabilities using Trivy.", {
         image: z.string().describe("Container image reference (e.g. nginx:latest, node:20-alpine)"),
@@ -355,8 +461,12 @@ export function registerTools(server, client) {
     // ── Venos: classify text against the engine ──────────────────────────────
     server.tool("venos_classify", "Run a piece of text (a prompt, a shell command, a tool argument) through venos and get back the policy decision (allow/deny). Call this BEFORE executing anything destructive or sensitive (rm, curl to unknown hosts, writes outside the workspace) so the decision is logged as a Cursor event in the dashboard.", {
         text: z.string().describe("The prompt, command, or content to classify."),
-    }, async ({ text }) => {
-        const r = await client.classify(text);
+        origin: z
+            .string()
+            .optional()
+            .describe("Optional label for where this content came from (e.g. a filename like 'insurance-database.xlsx'). Recorded on the event so it can be shown and filtered in the dashboard's ORIGIN column."),
+    }, async ({ text, origin }) => {
+        const r = await client.classify(text, origin);
         const lines = [
             `## Venos decision: \`${r.decision}\``,
             ``,
@@ -385,6 +495,37 @@ export function registerTools(server, client) {
         ];
         return { content: [{ type: "text", text: lines.join("\n") }] };
     });
+    // ── Venos: Claude Code usage rollup ──────────────────────────────────────
+    server.tool("venos_usage", "Show the organization's Claude Code usage tracked by venos: per-model token counts (input/output and cache read/write) with read-time-derived cost, plus which skills, subagents, and MCP servers were invoked most. Populated by `venos usage-sync` from device ~/.claude transcripts. Returns an empty-state note when nothing has been reported yet.", {
+        sinceHours: z
+            .number()
+            .int()
+            .min(1)
+            .optional()
+            .describe("Lookback window in hours (default: 30 days)."),
+    }, async ({ sinceHours }) => {
+        const usage = await client.usage(sinceHours);
+        return { content: [{ type: "text", text: formatClaudeUsage(usage) }] };
+    });
+    // ── Venos: report Claude Code usage ──────────────────────────────────────
+    // The aggregation reads the per-device ~/.claude transcripts, which only the
+    // device CLI can do reliably (the stdio MCP server may be running on a host
+    // without access to those files). Rather than fake a sync from here, this
+    // tool returns the exact command to run; venos_usage then reads the result.
+    server.tool("venos_usage_sync", "Report this device's Claude Code usage (tokens, cost, skill/subagent/MCP attribution) to venos. The usage data lives in ~/.claude transcripts, which the venos CLI reads directly; run the command this tool returns, then call venos_usage to see the rollup.", {}, async () => {
+        const lines = [
+            `## Report Claude Code usage to venos`,
+            ``,
+            `Claude Code usage is aggregated from this device's \`~/.claude\` transcripts by the venos CLI. Run:`,
+            ``,
+            "```",
+            `venos usage-sync`,
+            "```",
+            ``,
+            `Then call \`venos_usage\` to see the per-model cost and skill/subagent/MCP attribution rollup.`,
+        ];
+        return { content: [{ type: "text", text: lines.join("\n") }] };
+    });
     // ── Venos: control scorecard ─────────────────────────────────────────────
     server.tool("venos_controls", "List venos's active security controls from the control scorecard, each classified as a barrier (impossible-class: structural/cryptographic) or friction (tedious: detection/heuristics) per the Zero-Trust-for-AI-Agents design test.", {
         class: z
@@ -395,6 +536,20 @@ export function registerTools(server, client) {
         const data = await client.controls();
         return { content: [{ type: "text", text: formatControls(data, classFilter) }] };
     });
+    // ── Venos: internal knowledge search (RAG) ───────────────────────────────
+    server.tool("venos_knowledge_search", "Search the organization's internal knowledge base (runbooks, docs, policies indexed into venos) and return the most relevant chunks for a natural-language query, ranked by semantic similarity. Use to answer 'how do we do X here?' from org-specific material rather than guessing. Returns an empty result when nothing matches.", {
+        query: z.string().describe("Natural-language question or phrase to search the internal knowledge base for."),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(20)
+            .optional()
+            .describe("Max number of chunks to return (default 8, capped at 20)."),
+    }, async ({ query, limit }) => {
+        const hits = await client.knowledgeSearch(query, limit);
+        return { content: [{ type: "text", text: formatKnowledgeHits(query, hits) }] };
+    });
     // ── Venos: recent delegation chains ──────────────────────────────────────
     server.tool("venos_delegation", "List recent multi-agent delegation chains tracked by venos — each is one agent delegating to another (e.g. a Claude Code Task sub-agent), with the hop count and last activity. Use to see which agents are delegating work to which, and to find a chain (session) to inspect in the dashboard.", {
         limit: z.number().int().min(1).max(50).optional().describe("Max chains to return (default 20)"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venos-inc/venos",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Self-service CLI for venos — wire your AI client to the venos security gateway in one command.",
   "license": "UNLICENSED",
   "type": "module",

package/etc/mcp-server/node_modules/node-addon-api/node_addon_api.gyp

@@ -1,32 +0,0 @@
-{
-  'targets': [
-    {
-      'target_name': 'node_addon_api',
-      'type': 'none',
-      'sources': [ 'napi.h', 'napi-inl.h' ],
-      'direct_dependent_settings': {
-        'include_dirs': [ '.' ],
-        'includes': ['noexcept.gypi'],
-      }
-    },
-    {
-      'target_name': 'node_addon_api_except',
-      'type': 'none',
-      'sources': [ 'napi.h', 'napi-inl.h' ],
-      'direct_dependent_settings': {
-        'include_dirs': [ '.' ],
-        'includes': ['except.gypi'],
-      }
-    },
-    {
-      'target_name': 'node_addon_api_maybe',
-      'type': 'none',
-      'sources': [ 'napi.h', 'napi-inl.h' ],
-      'direct_dependent_settings': {
-        'include_dirs': [ '.' ],
-        'includes': ['noexcept.gypi'],
-        'defines': ['NODE_ADDON_API_ENABLE_MAYBE']
-      }
-    },
-  ]
-}