@weave_protocol/mund 0.4.1 → 0.5.0

package/src/server.ts

@@ -0,0 +1,390 @@
+#!/usr/bin/env node
+/**
+ * Mund - The Guardian Protocol
+ * Main Entry Point
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import express from 'express';
+
+import type { MundConfig, DetectionRule } from './types.js';
+import { DEFAULT_CONFIG, DEFAULT_RULES } from './constants.js';
+import { createStorage } from './storage/index.js';
+import { AnalyzerEngine } from './analyzers/index.js';
+import { NotificationHub } from './notifications/index.js';
+import { registerAllTools } from './tools/index.js';
+import { runScanCli } from './cli/scan.js';
+import { runAgentAuditCli, runCheckSkillCli } from './cli/agent.js';
+import { getVersion } from './version.js';
+import { loadCanariesFromEnv } from './canary.js';
+
+// Threat Intelligence imports
+import { threatIntel } from './threat-intel-manager.js';
+import { 
+  threatIntelTools, 
+  createThreatIntelToolHandlers,
+  UpdateThreatIntelSchema,
+  ListIntelSourcesSchema,
+  IntelStatusSchema,
+  AddIntelSourceSchema,
+  RemoveIntelSourceSchema,
+  ThreatScanSchema,
+  ListPatternsSchema,
+  TogglePatternSchema,
+} from './threat-intel-tools.js';
+
+// ============================================================================
+// Configuration Loading
+// ============================================================================
+
+function loadConfig(): MundConfig {
+  const config: MundConfig = {
+    ...DEFAULT_CONFIG,
+    
+    // Server settings from environment
+    port: parseInt(process.env.MUND_PORT || '3000'),
+    host: process.env.MUND_HOST || '127.0.0.1',
+    transport: (process.env.MUND_TRANSPORT as 'stdio' | 'http') || 'stdio',
+    
+    // Logging
+    log_level: (process.env.MUND_LOG_LEVEL as MundConfig['log_level']) || 'info',
+    
+    // Storage
+    storage_type: (process.env.MUND_STORAGE as MundConfig['storage_type']) || 'memory',
+    database_url: process.env.MUND_DATABASE_URL,
+    
+    // Security
+    block_mode: process.env.MUND_BLOCK_MODE === 'block',
+    api_key: process.env.MUND_API_KEY,
+    
+    // Notifications
+    notifications: {
+      slack: process.env.MUND_SLACK_WEBHOOK ? {
+        webhook_url: process.env.MUND_SLACK_WEBHOOK,
+        channel: process.env.MUND_SLACK_CHANNEL,
+        username: process.env.MUND_SLACK_USERNAME || 'Mund Guardian',
+        icon_emoji: process.env.MUND_SLACK_EMOJI || ':eye:',
+        min_severity: (process.env.MUND_SLACK_MIN_SEVERITY as any) || 'high'
+      } : undefined,
+      
+      teams: process.env.MUND_TEAMS_WEBHOOK ? {
+        webhook_url: process.env.MUND_TEAMS_WEBHOOK,
+        min_severity: (process.env.MUND_TEAMS_MIN_SEVERITY as any) || 'high'
+      } : undefined,
+      
+      email: process.env.MUND_EMAIL_SMTP_HOST ? {
+        smtp_host: process.env.MUND_EMAIL_SMTP_HOST,
+        smtp_port: parseInt(process.env.MUND_EMAIL_SMTP_PORT || '587'),
+        smtp_secure: process.env.MUND_EMAIL_SMTP_SECURE === 'true',
+        smtp_user: process.env.MUND_EMAIL_SMTP_USER,
+        smtp_pass: process.env.MUND_EMAIL_SMTP_PASS,
+        from_address: process.env.MUND_EMAIL_FROM || 'mund@localhost',
+        to_addresses: (process.env.MUND_EMAIL_TO || '').split(',').filter(Boolean),
+        min_severity: (process.env.MUND_EMAIL_MIN_SEVERITY as any) || 'high'
+      } : undefined,
+      
+      webhooks: process.env.MUND_WEBHOOK_URL ? [{
+        url: process.env.MUND_WEBHOOK_URL,
+        method: 'POST' as const,
+        headers: process.env.MUND_WEBHOOK_HEADERS ? JSON.parse(process.env.MUND_WEBHOOK_HEADERS) : undefined,
+        min_severity: (process.env.MUND_WEBHOOK_MIN_SEVERITY as 'critical' | 'high' | 'medium' | 'low' | 'info') || 'high'
+      }] : undefined
+    }
+  };
+
+  return config;
+}
+
+// ============================================================================
+// Threat Intelligence Tool Registration
+// ============================================================================
+
+function registerThreatIntelTools(server: McpServer): void {
+  const handlers = createThreatIntelToolHandlers(threatIntel);
+
+  // Map tool names to schemas
+  const schemaMap: Record<string, Record<string, any>> = {
+    'mund_update_threat_intel': UpdateThreatIntelSchema,
+    'mund_list_intel_sources': ListIntelSourcesSchema,
+    'mund_intel_status': IntelStatusSchema,
+    'mund_add_intel_source': AddIntelSourceSchema,
+    'mund_remove_intel_source': RemoveIntelSourceSchema,
+    'mund_threat_scan': ThreatScanSchema,
+    'mund_list_patterns': ListPatternsSchema,
+    'mund_toggle_pattern': TogglePatternSchema,
+  };
+
+  // Register each threat intel tool with Zod schema
+  for (const tool of threatIntelTools) {
+    const schema = schemaMap[tool.name];
+    if (!schema) continue;
+
+    server.tool(
+      tool.name,
+      tool.description,
+      schema,
+      async (args: any) => {
+        const handler = handlers[tool.name as keyof typeof handlers];
+        if (!handler) {
+          return {
+            content: [{ type: 'text' as const, text: JSON.stringify({ error: `Unknown tool: ${tool.name}` }) }]
+          };
+        }
+        
+        try {
+          const result = await handler(args);
+          return {
+            content: [{ type: 'text' as const, text: JSON.stringify(result, null, 2) }]
+          };
+        } catch (error) {
+          return {
+            content: [{ type: 'text' as const, text: JSON.stringify({ 
+              error: error instanceof Error ? error.message : String(error) 
+            }) }]
+          };
+        }
+      }
+    );
+  }
+}
+
+// ============================================================================
+// Server Initialization
+// ============================================================================
+
+async function createMundServer(config: MundConfig): Promise<McpServer> {
+  // Create MCP server
+  const server = new McpServer({
+    name: 'mund-mcp-server',
+    version: getVersion()
+  });
+
+  // Initialize storage
+  const storage = createStorage(config);
+
+  // Initialize analyzer engine
+  const analyzer = new AnalyzerEngine();
+
+  // Initialize notification hub
+  const notificationHub = new NotificationHub(config);
+
+  // Load rules (start with defaults, could be extended from file)
+  const rules: DetectionRule[] = [...DEFAULT_RULES];
+
+  // Load any saved custom rules from storage
+  const savedRules = await storage.getRules();
+  for (const rule of savedRules) {
+    if (!rules.find(r => r.id === rule.id)) {
+      rules.push(rule);
+    }
+  }
+
+  // Register all core tools
+  loadCanariesFromEnv();
+  registerAllTools(server, storage, rules, analyzer, notificationHub, config.block_mode);
+
+  // Register threat intelligence tools
+  registerThreatIntelTools(server);
+
+  // Get threat intel status for logging
+  const intelStatus = threatIntel.getStatus();
+
+  // Log startup info
+  console.error(`Mund Guardian Protocol v0.2.0`);
+  console.error(`- Transport: ${config.transport}`);
+  console.error(`- Storage: ${config.storage_type}`);
+  console.error(`- Block Mode: ${config.block_mode ? 'enabled' : 'disabled'}`);
+  console.error(`- Rules Loaded: ${rules.filter(r => r.enabled).length}`);
+  console.error(`- Threat Intel: ${intelStatus.patterns.total} patterns from ${intelStatus.sources.enabled} sources`);
+  console.error(`- Notifiers: ${notificationHub.getNotifierNames().join(', ') || 'none'}`);
+
+  return server;
+}
+
+// ============================================================================
+// Transport Handlers
+// ============================================================================
+
+async function runStdio(config: MundConfig): Promise<void> {
+  const server = await createMundServer(config);
+  const transport = new StdioServerTransport();
+  
+  await server.connect(transport);
+  console.error('Mund MCP server running on stdio');
+}
+
+async function runHTTP(config: MundConfig): Promise<void> {
+  const server = await createMundServer(config);
+  const app = express();
+  
+  app.use(express.json({ limit: '10mb' }));
+
+  // Health check endpoint
+  app.get('/health', (_req, res) => {
+    res.json({ status: 'ok', version: getVersion() });
+  });
+
+  // Threat intel status endpoint
+  app.get('/intel/status', (_req, res) => {
+    res.json(threatIntel.getStatus());
+  });
+
+  // MCP endpoint
+  app.post('/mcp', async (req, res) => {
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: undefined,
+      enableJsonResponse: true
+    });
+
+    res.on('close', () => transport.close());
+
+    await server.connect(transport);
+    await transport.handleRequest(req, res, req.body);
+  });
+
+  // Start server
+  app.listen(config.port, config.host, () => {
+    console.error(`Mund MCP server running on http://${config.host}:${config.port}/mcp`);
+  });
+}
+
+// ============================================================================
+// CLI and Main
+// ============================================================================
+
+function printHelp(): void {
+  console.log(`
+Mund - The Guardian Protocol
+MCP-based security monitoring for agentic AI systems
+
+Usage: mund-mcp [options]          Run the MCP server
+       mund-mcp scan [paths...]    Scan files (see: mund-mcp scan --help)
+       mund-mcp agent-audit        Audit installed skills + MCP servers
+       mund-mcp check-skill <path> Scan a skill before installing it
+
+Options:
+  --help, -h          Show this help message
+  --version, -v       Show version number
+  --transport <type>  Transport type: stdio (default) or http
+  --port <port>       HTTP port (default: 3000)
+  --host <host>       HTTP host (default: 127.0.0.1)
+  --block             Enable block mode (block dangerous content)
+
+Environment Variables:
+  MUND_PORT                   HTTP server port
+  MUND_HOST                   HTTP server host
+  MUND_TRANSPORT              Transport type (stdio or http)
+  MUND_LOG_LEVEL              Log level (debug, info, warn, error)
+  MUND_STORAGE                Storage type (memory, sqlite, postgres)
+  MUND_DATABASE_URL           Database connection URL
+  MUND_BLOCK_MODE             Set to 'block' to enable blocking
+  MUND_API_KEY                API key for authentication
+  
+  MUND_SLACK_WEBHOOK          Slack webhook URL
+  MUND_SLACK_CHANNEL          Slack channel override
+  MUND_SLACK_MIN_SEVERITY     Minimum severity for Slack alerts
+  
+  MUND_TEAMS_WEBHOOK          Microsoft Teams webhook URL
+  MUND_TEAMS_MIN_SEVERITY     Minimum severity for Teams alerts
+  
+  MUND_EMAIL_SMTP_HOST        SMTP server host
+  MUND_EMAIL_SMTP_PORT        SMTP server port
+  MUND_EMAIL_FROM             From address for emails
+  MUND_EMAIL_TO               Comma-separated recipient addresses
+  
+  MUND_WEBHOOK_URL            Generic webhook URL
+  MUND_WEBHOOK_HEADERS        JSON string of webhook headers
+
+Threat Intelligence:
+  Built-in threat patterns with MITRE ATT&CK mapping.
+  Use mund_intel_status to check coverage.
+  Use mund_update_threat_intel to pull latest patterns.
+
+Examples:
+  # Run as stdio server (for MCP clients)
+  mund-mcp
+  
+  # Run as HTTP server
+  mund-mcp --transport http --port 3000
+  
+  # Run with Slack notifications
+  MUND_SLACK_WEBHOOK=https://hooks.slack.com/... mund-mcp
+  
+  # Run in block mode
+  mund-mcp --block
+
+For more information, visit: https://github.com/Tyox-all/Weave_Protocol
+`);
+}
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+
+  if (args[0] === 'scan') {
+    process.exit(await runScanCli(args.slice(1)));
+  }
+  if (args[0] === 'agent-audit') {
+    process.exit(await runAgentAuditCli(args.slice(1)));
+  }
+  if (args[0] === 'check-skill') {
+    process.exit(await runCheckSkillCli(args.slice(1)));
+  }
+
+  // Parse CLI arguments
+  if (args.includes('--help') || args.includes('-h')) {
+    printHelp();
+    process.exit(0);
+  }
+
+  if (args.includes('--version') || args.includes('-v')) {
+    console.log(getVersion());
+    process.exit(0);
+  }
+
+  // Load config
+  const config = loadConfig();
+
+  // Override from CLI
+  const transportIndex = args.indexOf('--transport');
+  if (transportIndex !== -1 && args[transportIndex + 1]) {
+    config.transport = args[transportIndex + 1] as 'stdio' | 'http';
+  }
+
+  const portIndex = args.indexOf('--port');
+  if (portIndex !== -1 && args[portIndex + 1]) {
+    config.port = parseInt(args[portIndex + 1]);
+  }
+
+  const hostIndex = args.indexOf('--host');
+  if (hostIndex !== -1 && args[hostIndex + 1]) {
+    config.host = args[hostIndex + 1];
+  }
+
+  if (args.includes('--block')) {
+    config.block_mode = true;
+  }
+
+  // Run appropriate transport
+  try {
+    if (config.transport === 'http') {
+      await runHTTP(config);
+    } else {
+      await runStdio(config);
+    }
+  } catch (error) {
+    console.error('Failed to start Mund server:', error);
+    process.exit(1);
+  }
+}
+
+// Run
+main().catch(error => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});
+
+// ============================================================================
+// Exports for programmatic use
+// ============================================================================