@vk.amogh/trace 2.1.0

package/src/trace_engine/mcp/config.py

@@ -0,0 +1,42 @@
+"""Project-local MCP configuration generator (Section 64)."""
+
+import json
+import sys
+from pathlib import Path
+from typing import Optional
+
+
+def generate_mcp_json(project_dir: Path, trace_cmd_path: Optional[str] = None) -> Path:
+    """Generate .mcp.json in the repository directory."""
+    project_dir = project_dir.resolve()
+    mcp_file = project_dir / ".mcp.json"
+
+    import shutil
+
+    candidate_cmd = (Path(__file__).parent.parent.parent.parent / "trace.cmd").resolve()
+    if trace_cmd_path:
+        cmd = trace_cmd_path
+        args = ["mcp"]
+    elif sys.platform == "win32" and candidate_cmd.exists():
+        cmd = str(candidate_cmd)
+        args = ["mcp"]
+    elif shutil.which("trace"):
+        cmd = "trace"
+        args = ["mcp"]
+    else:
+        cmd = sys.executable
+        args = ["-m", "trace_engine.cli", "mcp"]
+
+    config_data = {
+        "mcpServers": {
+            "trace": {
+                "command": cmd,
+                "args": args,
+            }
+        }
+    }
+
+    with open(mcp_file, "w", encoding="utf-8") as f:
+        json.dump(config_data, f, indent=2)
+
+    return mcp_file

package/src/trace_engine/mcp/server.py

@@ -0,0 +1,398 @@
+"""TRACE Model Context Protocol (MCP) stdio server implementation."""
+
+import sys
+import json
+import logging
+from pathlib import Path
+from typing import Dict, Any, Optional, List
+
+from trace_engine.findings.store import FindingStore
+from trace_engine.verify import VerificationEngine
+from trace_engine.ingest.repository import RepositoryScanner
+from trace_engine.parsing.parser import CodeParser
+from trace_engine.framework import get_adapters
+from trace_engine.apm.builder import APMBuilder
+from trace_engine.apm.model import AttackPathModel
+from trace_engine.security.hypotheses import HypothesisEngine
+from trace_engine.policy.scope import ScopeGuard
+from trace_engine.runtime.client import ScopedHttpClient
+from trace_engine.testpacks.registry import default_registry
+from trace_engine.testpacks.base import TestContext
+from trace_engine.findings.correlate import EvidenceCorrelator
+from trace_engine.config.loader import load_config, get_trace_dir
+
+logger = logging.getLogger("trace_mcp")
+
+# MCP Specification Tool Definitions
+TRACE_TOOLS = [
+    {
+        "name": "trace_scan",
+        "description": "Run complete TRACE static + runtime security audit on repository.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "repository": {"type": "string", "default": ".", "description": "Path to target repository"},
+                "target": {"type": "string", "default": "http://127.0.0.1:18080", "description": "Target HTTP runtime URL"},
+                "profile": {"type": "string", "default": "standard", "enum": ["quick", "standard", "deep"]},
+            },
+            "required": ["repository"],
+        },
+    },
+    {
+        "name": "trace_status",
+        "description": "Get current status and statistics of TRACE engine in repository.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "repository": {"type": "string", "default": "."},
+            },
+        },
+    },
+    {
+        "name": "trace_findings",
+        "description": "Retrieve all correlated vulnerability findings for repository.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "repository": {"type": "string", "default": "."},
+                "severity": {"type": "string", "description": "Filter by minimum severity"},
+            },
+        },
+    },
+    {
+        "name": "trace_explain",
+        "description": "Retrieve root cause explanation, attack path, and evidence for a finding.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "finding_id": {"type": "string", "description": "Finding identifier (e.g. TR-BOLA-001)"},
+                "repository": {"type": "string", "default": "."},
+            },
+            "required": ["finding_id"],
+        },
+    },
+    {
+        "name": "trace_attack_path",
+        "description": "Inspect Attack-Path Model hops connecting an endpoint to dangerous sinks.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "endpoint": {"type": "string", "description": "Endpoint path (e.g. /api/orders/{id})"},
+                "repository": {"type": "string", "default": "."},
+            },
+            "required": ["endpoint"],
+        },
+    },
+    {
+        "name": "trace_verify",
+        "description": "Verify whether a code modification by a coding agent resolved a finding.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "finding_id": {"type": "string", "description": "Finding identifier to verify"},
+                "repository": {"type": "string", "default": "."},
+                "target": {"type": "string", "default": "http://127.0.0.1:18080"},
+            },
+            "required": ["finding_id"],
+        },
+    },
+    {
+        "name": "trace_harness_task",
+        "description": "Retrieve benchmark task specification (SWE-bench format) for a security finding to guide an autonomous agent harness.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "finding_id": {"type": "string", "description": "Finding identifier (e.g. TR-BOLA-001)"},
+                "repository": {"type": "string", "default": "."},
+            },
+            "required": ["finding_id"],
+        },
+    },
+    {
+        "name": "trace_eval_patch",
+        "description": "Evaluate an agent's proposed patch or diff against the TRACE verification oracle and exploit tests.",
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "finding_id": {"type": "string", "description": "Finding identifier"},
+                "patch_content": {"type": "string", "description": "Full new content for the target file"},
+                "target_file": {"type": "string", "description": "Relative path to target file in repository"},
+                "repository": {"type": "string", "default": "."},
+                "target": {"type": "string", "default": "http://127.0.0.1:18080"},
+                "rollback_after": {"type": "boolean", "default": False, "description": "Whether to rollback the patch after evaluation"},
+            },
+            "required": ["finding_id"],
+        },
+    },
+]
+
+
+class TraceMCPServer:
+    """Stdio JSON-RPC 2.0 MCP server for coding agent handoff."""
+
+    def __init__(self):
+        self.running = True
+
+    def handle_request(self, request: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+        method = request.get("method")
+        msg_id = request.get("id")
+        params = request.get("params", {})
+
+        if method == "initialize":
+            return {
+                "jsonrpc": "2.0",
+                "id": msg_id,
+                "result": {
+                    "protocolVersion": "2024-11-05",
+                    "serverInfo": {
+                        "name": "trace-security-mcp",
+                        "version": "2.0.0",
+                    },
+                    "capabilities": {"tools": {}},
+                },
+            }
+
+        elif method == "notifications/initialized":
+            return None
+
+        elif method == "tools/list":
+            return {
+                "jsonrpc": "2.0",
+                "id": msg_id,
+                "result": {"tools": TRACE_TOOLS},
+            }
+
+        elif method == "tools/call":
+            tool_name = params.get("name")
+            args = params.get("arguments", {})
+            try:
+                res_content = self.execute_tool(tool_name, args)
+                return {
+                    "jsonrpc": "2.0",
+                    "id": msg_id,
+                    "result": {
+                        "content": [
+                            {"type": "text", "text": json.dumps(res_content, indent=2)}
+                        ]
+                    },
+                }
+            except Exception as e:
+                return {
+                    "jsonrpc": "2.0",
+                    "id": msg_id,
+                    "error": {"code": -32000, "message": str(e)},
+                }
+
+        elif method == "ping":
+            return {"jsonrpc": "2.0", "id": msg_id, "result": {}}
+
+        return {
+            "jsonrpc": "2.0",
+            "id": msg_id,
+            "error": {"code": -32601, "message": f"Method {method} not found"},
+        }
+
+    def execute_tool(self, name: str, args: Dict[str, Any]) -> Any:
+        repo_path = Path(args.get("repository", ".")).resolve()
+        target_url = args.get("target", "http://127.0.0.1:18080")
+
+        if name == "trace_status":
+            trace_dir = repo_path / ".trace"
+            store = FindingStore(trace_dir)
+            findings = store.load_findings()
+            return {
+                "repository": str(repo_path),
+                "initialized": trace_dir.exists(),
+                "total_findings": len(findings),
+                "confirmed": sum(1 for f in findings if f.confidence.value == "CONFIRMED"),
+            }
+
+        elif name == "trace_findings":
+            store = FindingStore(repo_path / ".trace")
+            findings = store.load_findings()
+            return [
+                {
+                    "id": f.id,
+                    "title": f.title,
+                    "category": f.category,
+                    "severity": f.severity.value,
+                    "confidence": f.confidence.value,
+                    "endpoint": f.endpoint,
+                    "remediation": f.remediation,
+                    "source": str(f.source_location) if f.source_location else None,
+                }
+                for f in findings
+            ]
+
+        elif name == "trace_explain":
+            finding_id = args.get("finding_id", "")
+            store = FindingStore(repo_path / ".trace")
+            finding = store.get_finding_by_id(finding_id)
+            if not finding:
+                return {"error": f"Finding {finding_id} not found."}
+            return {
+                "id": finding.id,
+                "title": finding.title,
+                "category": finding.category,
+                "severity": finding.severity.value,
+                "confidence": finding.confidence.value,
+                "endpoint": finding.endpoint,
+                "source": str(finding.source_location),
+                "attack_path": finding.attack_path,
+                "static_evidence": finding.static_evidence,
+                "runtime_evidence": finding.runtime_evidence,
+                "correlation_notes": finding.correlation_notes,
+                "reproduction_steps": finding.reproduction_steps,
+                "remediation": finding.remediation,
+            }
+
+        elif name == "trace_verify":
+            finding_id = args.get("finding_id", "")
+            engine = VerificationEngine(repo_path=repo_path, target_url=target_url)
+            res = engine.verify(finding_id)
+            return res.model_dump()
+
+        elif name == "trace_scan":
+            # Execute scan programmatic flow
+            scanner = RepositoryScanner(repo_path)
+            source_files = scanner.scan()
+            parser = CodeParser()
+            adapters = get_adapters()
+
+            parsed_files = []
+            discovered_endpoints = []
+            for sf in source_files:
+                content = Path(sf.absolute_path).read_text(encoding="utf-8", errors="replace")
+                pf = parser.parse(sf.path, content, sf.language, absolute_path=sf.absolute_path)
+                parsed_files.append(pf)
+                for adapter in adapters:
+                    if adapter.can_handle(pf):
+                        discovered_endpoints.extend(adapter.extract_endpoints(pf, content))
+
+            builder = APMBuilder(project_name=repo_path.name)
+            apm = builder.build(repo_path, source_files, parsed_files, discovered_endpoints)
+
+            engine = HypothesisEngine()
+            hypotheses = engine.derive_hypotheses(apm, discovered_endpoints)
+
+            scope_guard = ScopeGuard()
+            scope_guard.allow_target(target_url)
+            client = ScopedHttpClient(scope_guard=scope_guard)
+            context = TestContext(
+                target_base_url=target_url,
+                active_tokens={"user-a": "user-a", "user-b": "user-b", "admin": "admin"},
+            )
+
+            correlator = EvidenceCorrelator()
+            findings = []
+            for hyp in hypotheses:
+                pack = default_registry.get(hyp.recommended_test_pack)
+                test_res = None
+                if pack:
+                    try:
+                        test_res = pack.execute(hyp, client, context)
+                    except Exception:
+                        test_res = None
+                f = correlator.correlate(hyp, test_res, apm)
+                if f:
+                    findings.append(f)
+
+            store = FindingStore(repo_path / ".trace")
+            store.save_findings(findings)
+
+            return {
+                "status": "completed",
+                "total_findings": len(findings),
+                "confirmed": sum(1 for f in findings if f.confidence.value == "CONFIRMED"),
+                "endpoints_audited": len(discovered_endpoints),
+            }
+
+        elif name == "trace_attack_path":
+            endpoint_str = args.get("endpoint", "")
+            store = FindingStore(repo_path / ".trace")
+            for f in store.load_findings():
+                if endpoint_str.lower() in f.endpoint.lower():
+                    return {"endpoint": f.endpoint, "attack_path": f.attack_path}
+            return {"endpoint": endpoint_str, "attack_path": []}
+
+        elif name == "trace_harness_task":
+            finding_id = args.get("finding_id", "")
+            from trace_engine.plugin import TraceHarnessPlugin
+            plugin = TraceHarnessPlugin(repo_path=repo_path, target_url=target_url)
+            task = plugin.get_task(finding_id)
+            if not task:
+                return {"error": f"Harness task for finding '{finding_id}' not found."}
+            return task.model_dump()
+
+        elif name == "trace_eval_patch":
+            finding_id = args.get("finding_id", "")
+            patch_content = args.get("patch_content")
+            target_file = args.get("target_file")
+            rollback = args.get("rollback_after", False)
+            from trace_engine.plugin import TraceHarnessPlugin
+            plugin = TraceHarnessPlugin(repo_path=repo_path, target_url=target_url)
+            eval_res = plugin.evaluate_patch(
+                finding_id=finding_id,
+                patch_content=patch_content,
+                target_file=target_file,
+                rollback_after=rollback,
+            )
+            return eval_res.model_dump()
+
+        return {"error": f"Unknown tool: {name}"}
+
+    def run_stdio(self):
+        """Run the stdio JSON-RPC loop supporting both line-delimited JSON and Content-Length headers."""
+        while self.running:
+            line = sys.stdin.readline()
+            if not line:
+                break
+            line_str = line.strip()
+            if not line_str:
+                continue
+
+            # Support Content-Length framing if sent by client
+            if line_str.lower().startswith("content-length:"):
+                try:
+                    content_length = int(line_str.split(":", 1)[1].strip())
+                    while True:
+                        hdr = sys.stdin.readline()
+                        if not hdr or hdr.strip() == "":
+                            break
+                    body = sys.stdin.read(content_length)
+                    req = json.loads(body)
+                except Exception as e:
+                    err_resp = {
+                        "jsonrpc": "2.0",
+                        "id": None,
+                        "error": {"code": -32700, "message": f"Parse error: {e}"},
+                    }
+                    sys.stdout.write(json.dumps(err_resp) + "\n")
+                    sys.stdout.flush()
+                    continue
+            else:
+                try:
+                    req = json.loads(line_str)
+                except Exception as e:
+                    err_resp = {
+                        "jsonrpc": "2.0",
+                        "id": None,
+                        "error": {"code": -32700, "message": f"Parse error: {e}"},
+                    }
+                    sys.stdout.write(json.dumps(err_resp) + "\n")
+                    sys.stdout.flush()
+                    continue
+
+            try:
+                resp = self.handle_request(req)
+                if resp is not None:
+                    sys.stdout.write(json.dumps(resp) + "\n")
+                    sys.stdout.flush()
+            except Exception as e:
+                err_resp = {
+                    "jsonrpc": "2.0",
+                    "id": req.get("id") if isinstance(req, dict) else None,
+                    "error": {"code": -32603, "message": f"Internal error: {e}"},
+                }
+                sys.stdout.write(json.dumps(err_resp) + "\n")
+                sys.stdout.flush()

package/src/trace_engine/output/__init__.py

@@ -0,0 +1,28 @@
+"""Output and rendering module."""
+
+from trace_engine.output.terminal import (
+    print_banner,
+    print_security_notes,
+    print_endpoints_table,
+    print_hypotheses_table,
+    print_findings_table,
+    print_finding_detail,
+    print_doctor_report,
+)
+from trace_engine.output.markdown import generate_markdown_report
+from trace_engine.output.html import generate_html_report
+from trace_engine.output.sarif import generate_sarif_report, export_sarif_json
+
+__all__ = [
+    "print_banner",
+    "print_security_notes",
+    "print_endpoints_table",
+    "print_hypotheses_table",
+    "print_findings_table",
+    "print_finding_detail",
+    "print_doctor_report",
+    "generate_markdown_report",
+    "generate_html_report",
+    "generate_sarif_report",
+    "export_sarif_json",
+]

package/src/trace_engine/output/html.py

@@ -0,0 +1,142 @@
+"""Standalone dark-themed HTML report generator with green accents."""
+
+import html
+from typing import List
+from trace_engine.findings.model import Finding
+
+
+def generate_html_report(findings: List[Finding], project_name: str = "Application") -> str:
+    cards = []
+    for f in findings:
+        sev_color = {
+            "CRITICAL": "#ff4d4d",
+            "HIGH": "#ff7733",
+            "MEDIUM": "#ffcc00",
+            "LOW": "#33ccff",
+        }.get(f.severity.value, "#888888")
+
+        cards.append(f"""
+        <div class="card">
+            <div class="card-header">
+                <span class="finding-id">{html.escape(f.id)}</span>
+                <span class="badge" style="background: {sev_color}; color: #000;">{f.severity.value}</span>
+                <span class="badge badge-conf">{f.confidence.value}</span>
+                <span class="category">{html.escape(f.category)}</span>
+            </div>
+            <h3 class="card-title">{html.escape(f.title)}</h3>
+            <p class="endpoint"><code>{html.escape(f.endpoint)}</code></p>
+            <div class="section-title">Static Code Evidence</div>
+            <ul>{"".join(f"<li>{html.escape(e)}</li>" for e in f.static_evidence)}</ul>
+            <div class="section-title">Runtime Behavioral Evidence</div>
+            <ul>{"".join(f"<li>{html.escape(e)}</li>" for e in f.runtime_evidence)}</ul>
+            <div class="section-title">Remediation</div>
+            <p class="remediation">{html.escape(f.remediation)}</p>
+        </div>
+        """)
+
+    return f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>TRACE Report — {html.escape(project_name)}</title>
+    <style>
+        body {{
+            background-color: #0c0d0e;
+            color: #e6edf3;
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, monospace;
+            margin: 0;
+            padding: 30px;
+        }}
+        .header {{
+            border-bottom: 1px solid #21262d;
+            padding-bottom: 20px;
+            margin-bottom: 30px;
+        }}
+        h1 {{
+            color: #00FF66;
+            margin: 0 0 8px 0;
+            font-size: 28px;
+            letter-spacing: -0.5px;
+        }}
+        .subtitle {{
+            color: #8b949e;
+            font-size: 14px;
+        }}
+        .card {{
+            background: #161b22;
+            border: 1px solid #30363d;
+            border-radius: 8px;
+            padding: 20px;
+            margin-bottom: 20px;
+        }}
+        .card-header {{
+            display: flex;
+            align-items: center;
+            gap: 12px;
+            margin-bottom: 12px;
+        }}
+        .finding-id {{
+            font-family: monospace;
+            font-weight: bold;
+            color: #00FF66;
+        }}
+        .badge {{
+            font-size: 11px;
+            font-weight: bold;
+            padding: 2px 8px;
+            border-radius: 4px;
+            text-transform: uppercase;
+        }}
+        .badge-conf {{
+            background: #00FF66;
+            color: #000;
+        }}
+        .category {{
+            color: #8b949e;
+            font-size: 12px;
+        }}
+        .card-title {{
+            margin: 0 0 10px 0;
+            font-size: 18px;
+        }}
+        code {{
+            background: #0d1117;
+            padding: 4px 8px;
+            border-radius: 4px;
+            color: #00FF66;
+        }}
+        .section-title {{
+            font-size: 12px;
+            font-weight: bold;
+            color: #8b949e;
+            text-transform: uppercase;
+            margin-top: 15px;
+            margin-bottom: 5px;
+        }}
+        ul {{
+            margin: 0 0 10px 0;
+            padding-left: 20px;
+            color: #c9d1d9;
+            font-size: 14px;
+        }}
+        .remediation {{
+            background: #0d1117;
+            border-left: 3px solid #00FF66;
+            padding: 10px 14px;
+            font-size: 13px;
+            color: #8b949e;
+            margin: 5px 0 0 0;
+        }}
+    </style>
+</head>
+<body>
+    <div class="header">
+        <h1>TRACE Security Assessment</h1>
+        <div class="subtitle">Threat Reconnaissance & Attack-path Correlation Engine • {html.escape(project_name)}</div>
+    </div>
+    <div class="findings-container">
+        {"".join(cards) if cards else "<p>No correlated vulnerabilities detected.</p>"}
+    </div>
+</body>
+</html>
+"""