@zivis/mcp 0.1.8 → 0.1.10

package/dist/pattern-packs/zivis-public-0.2.0/capsules/security/late-org-filter.yaml

@@ -0,0 +1,266 @@
+# Capsule: Late org-filter — cross-tenant leak via presentation-time scoping
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: security.late-org-filter
+slug: late-org-filter
+version: 0.1.0
+category: security
+title: Late Org Filter
+headline: Tenant Scoping Applied After the Query, Not Inside It
+description: >
+  Detects multi-tenant code paths where org/tenant filtering happens at the
+  presentation layer (response loop, stream emit, response shaping) instead
+  of inside the data query. Any race, error path, or partial response that
+  reaches the wire before the filter fires leaks rows across tenants.
+
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+  - go
+
+relevance_filter:
+  any_of:
+    - dependency: express
+      direct_only: true
+    - dependency: fastify
+      direct_only: true
+    - dependency: hono
+      direct_only: true
+    - dependency: "@nestjs/core"
+      direct_only: true
+    - dependency: fastapi
+      direct_only: true
+    - dependency: flask
+      direct_only: true
+    - dependency: "django"
+      direct_only: true
+    - dependency: "github.com/gin-gonic/gin"
+      direct_only: true
+    - dependency: "github.com/labstack/echo/v4"
+      direct_only: true
+  none_of:
+    # If the project clearly isn't multi-tenant, skip — no benefit, lots of noise.
+    - evidence: "single_tenant_only_marker"
+
+strategies:
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          # Filter applied to a query result then sent — classic shape.
+          - pattern: $ROWS.filter($_ => $_.orgId === $$$)
+          - pattern: $ROWS.filter($_ => $_.org_id === $$$)
+          - pattern: $ROWS.filter($_ => $_.tenantId === $$$)
+          # Per-row tenant guard inside a loop — the SSE / iterator variant.
+          - pattern: |
+              if ($R.orgId === $$$) {
+                $$$
+              }
+          - pattern: |
+              if ($R.org_id === $$$) {
+                $$$
+              }
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        any:
+          - pattern: |
+              rows = $QUERY($$$)
+              filtered = [r for r in rows if r.org_id == $REQ.org_id]
+          - pattern: |
+              for row in $QUERY($$$):
+                if row.org_id == request.org_id:
+                  yield row
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: GRAPH
+    expression: |
+      query_call_returns_rows
+      AND filter_predicate_references(req_org_id OR session_org_id)
+      AND filter_executes_AFTER(query_call) IN response_handler_or_stream_emit
+      AND query_call.where_clause DOES_NOT include org_id
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.30
+
+  - code: META
+    expression:
+      none_of_controls:
+        - row_level_security_policy
+        - prisma_extension_or_middleware_attaching_org_filter
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.20
+
+  - code: INFER
+    expression: prompt_id:security.late-org-filter.identify
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 2
+
+control_negations:
+  - "presence_of(row_level_security_policy)"
+  - "presence_of(query_helper_with_implicit_org_scope)"
+  - "presence_of(prisma_extension_or_middleware_attaching_org_filter)"
+
+threats:
+  - title: Cross-tenant data leak via SSE / stream pre-filter window
+    stride: [information_disclosure, elevation_of_privilege]
+    description: >
+      In a streaming or async-iterator response, the underlying query returns
+      rows from all tenants and the per-emit filter rejects mismatches. A
+      brief window where rows are buffered, logged, traced, or partially
+      rendered before the filter executes can leak data across tenants. This
+      is the SSE / queue/stream variant of the pattern.
+    remediation: >
+      Push the org/tenant predicate into the data layer — RLS, query helpers,
+      ORM middleware. Make every query mandatorily org-scoped at the boundary;
+      treat presentation-layer filters as defense in depth, never the primary
+      barrier.
+  - title: Cross-tenant leak via error path or partial response
+    stride: [information_disclosure]
+    description: >
+      An exception inside the post-query filter loop returns the unfiltered
+      buffer or a serialization mid-state. Other tenants' rows reach the
+      wire because the only org check sits past the failure point.
+    remediation: >
+      Same control — RLS or query-time scoping. Plus: serialize the response
+      body only after filtering completes; on filter error, return a
+      structured error with no payload.
+  - title: Logged or traced rows expose other tenants
+    stride: [information_disclosure, repudiation]
+    description: >
+      Observability hooks (request logger, tracer, metrics) often capture the
+      raw query result before the presentation-layer filter runs. Other
+      tenants' identifiers, names, or PII land in logs the requesting tenant
+      should never have seen.
+    remediation: >
+      Either log only post-filter results, or — better — make the query
+      itself org-scoped so the unfiltered result never exists.
+
+fixtures:
+  positive:
+    - "fixtures/positive/late-org-filter/express_sse_post_filter_typescript"
+    - "fixtures/positive/late-org-filter/fastapi_iterator_post_filter_python"
+  negative:
+    - "fixtures/negative/late-org-filter/prisma_middleware_org_scope"
+    - "fixtures/negative/late-org-filter/postgres_rls_enabled"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - multi-tenant
+  - cross-tenant-leak
+  - data-scoping
+  - sse
+  - stream
+
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Tenant filtering applied after the query — at the response loop, the SSE
+  emit, or the stream iterator — instead of inside the query. Any error,
+  race, observability hook, or partial response that fires before the filter
+  reaches the wire leaks rows across tenants. The fix is to push org/tenant
+  scoping down to the data layer (RLS, query helpers, ORM middleware) so the
+  unfiltered set never exists in the first place.
+
+detect_when: >
+  A handler, stream, or async iterator runs a data query, then filters the
+  result by `request.orgId` (or a session org) before responding — and the
+  query itself doesn't include the org predicate. Multi-tenant routes only.
+
+risk_hints:
+  - The bug class behind a meaningful share of cross-tenant SaaS incidents
+  - SSE / queue / WebSocket variants are the hardest to spot because the filter looks "inside" the loop
+  - Logs and traces often capture the unfiltered set even when the response itself is clean
+  - Tests often pass because they only run with a single tenant in the test database
+
+architectural_signals:
+  - Query call followed by an explicit filter referencing a request/session org id
+  - SSE or async iterator that yields events conditional on a tenant match
+  - No row-level security policy, no implicit-org-scope helper, no ORM middleware
+
+model_task_prompt_ref: prompts/security/late-org-filter/identify.md
+
+expected_output_schema:
+  type: object
+  required: [verdict, scope_location, evidence_spans]
+  properties:
+    verdict:
+      type: string
+      enum: [late_filter_present, scoped_at_query, partial_scope, unclear]
+    scope_location:
+      type: string
+      enum: [data_layer, query_layer, presentation_layer, multiple, none]
+    rationale:
+      type: string
+    blast_radius:
+      type: string
+      enum: [single_endpoint, route_family, service_wide, unclear]
+    recommended_controls:
+      type: array
+      items:
+        type: string
+        enum: [row_level_security, query_helper, orm_middleware, repository_pattern_with_org_scope, none]
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 100
+  symbols:
+    - orgId
+    - org_id
+    - tenant_id
+    - filter
+    - SSE
+    - stream
+
+related_patterns:
+  - security.idor-via-direct-id
+  - security.broken-object-level-authz
+
+repair_contract:
+  allowed:
+    - Push org/tenant scoping into the query (where clause, RLS, ORM middleware)
+    - Introduce a repository wrapper that mandates org_id on every method
+    - Add a Postgres row-level security policy
+    - Keep the presentation-layer filter as defense in depth IN ADDITION TO the data-layer scope
+  forbidden:
+    - Removing the presentation-layer filter without first introducing a data-layer scope (regresses safety)
+    - Treating the patch as complete after only fixing the immediate route — the bug class is structural
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - data_layer_org_scope_present_after_patch
+    - no_unscoped_query_remains_in_route_handler
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates

package/dist/pattern-packs/zivis-public-0.2.0/controls/external_validator_on_facts.yaml

@@ -0,0 +1,37 @@
+# Control: external_validator_on_facts
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#
+# An external (non-LLM) check that the aggregated answer is factually
+# consistent — a SQL query, an API call, a regex against ground truth, etc.
+
+id: external_validator_on_facts
+description: >
+  An external, non-LLM check applied to the aggregated answer before it's
+  acted on. Common shapes: factCheck()/validateFacts() helpers, schema
+  validation, lookup against a trusted store.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        - pattern: factCheck($$$)
+        - pattern: validateFacts($$$)
+        - pattern: validateAnswer($$$)
+        - pattern: $_.factCheck($$$)
+        - pattern: $_.validate($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: fact_check($$$)
+        - pattern: validate_facts($$$)
+        - pattern: validate_answer($$$)
+        - pattern: $_.validate_against_ground_truth($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/fact_validator_present.yaml

@@ -0,0 +1,68 @@
+# Control: fact_validator_present
+# Referenced by:
+#   - retrieval.context-injection-no-validator (META: none_of_controls)
+#
+# A validator that inspects retrieved or LLM-generated content for
+# prompt-injection patterns, factual inconsistency, or policy violations
+# before the content reaches the model (or the user). Presence of any of
+# the well-known guardrails libraries OR a custom validator with a
+# recognizable name counts.
+
+id: fact_validator_present
+description: >
+  A validator step that inspects content for injection / hallucination /
+  policy violations between the data source (retriever, tool, user input)
+  and the model — or between the model and the user. Either a recognizable
+  third-party guardrails library or a custom validator with a clear name.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Third-party guardrails libraries (presence of the import or call)
+        - pattern: from "guardrails"
+        - pattern: from "@guardrails-ai/core"
+        - pattern: from "nemoguardrails"
+        - pattern: from "@nvidia/nemo-guardrails"
+        - pattern: from "lakera-guard"
+        - pattern: from "@lakera/guard"
+        - pattern: from "llm-guard"
+        - pattern: from "@protectai/llm-guard"
+        - pattern: from "presidio-analyzer"
+        # Conventional function names — broad on purpose so customer
+        # codebases register when they roll their own
+        - pattern: validateRetrievedContent($$$)
+        - pattern: validateContent($$$)
+        - pattern: factCheck($$$)
+        - pattern: checkForInjection($$$)
+        - pattern: sanitizeRetrieved($$$)
+        - pattern: detectPromptInjection($$$)
+        - pattern: $_.validate($DOCS)
+        - pattern: $_.guard($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: import guardrails
+        - pattern: from guardrails import $$$
+        - pattern: import nemoguardrails
+        - pattern: from nemoguardrails import $$$
+        - pattern: import lakera_guard
+        - pattern: from lakera_guard import $$$
+        - pattern: import llm_guard
+        - pattern: from llm_guard import $$$
+        - pattern: from presidio_analyzer import $$$
+        # Conventional function names
+        - pattern: validate_retrieved_content($$$)
+        - pattern: validate_content($$$)
+        - pattern: fact_check($$$)
+        - pattern: check_for_injection($$$)
+        - pattern: sanitize_retrieved($$$)
+        - pattern: detect_prompt_injection($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/human_approval_gate.yaml

@@ -0,0 +1,44 @@
+# Control: human_approval_gate
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#   - agents.privilege-separation (potential — high-impact tool dispatch)
+#
+# Defines what "the codebase has a human-in-the-loop approval before
+# committing a high-impact action" looks like. Detection is intentionally
+# fuzzy — we'd rather over-detect approval gates (and miss firing META)
+# than under-detect (and fire false-positive findings).
+
+id: human_approval_gate
+description: >
+  Detects code that pauses execution to wait for human approval before
+  committing a high-impact action. Common shapes: humanInTheLoop helpers,
+  LangGraph interrupts, await-on-approval queue reads, request-confirmation
+  prompts.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        - pattern: humanInTheLoop($$$)
+        - pattern: humanApproval($$$)
+        - pattern: requireApproval($$$)
+        - pattern: await $_.waitForApproval($$$)
+        - pattern: await $_.awaitApproval($$$)
+        - pattern: $_.interrupt($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: human_in_the_loop($$$)
+        - pattern: human_approval($$$)
+        - pattern: require_approval($$$)
+        - pattern: wait_for_user($$$)
+        - pattern: await_approval($$$)
+        - pattern: $_.interrupt($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/langgraph_state_machine_with_per_node_tools.yaml

@@ -0,0 +1,35 @@
+# Control: langgraph_state_machine_with_per_node_tools
+# Referenced by:
+#   - agents.privilege-separation (META: none_of_controls)
+#
+# LangGraph's idiom for privilege separation: a StateGraph with multiple
+# nodes, each binding a different (smaller) tool set. When present, the
+# capsule's anti-pattern (one shared tool list) is mitigated.
+
+id: langgraph_state_machine_with_per_node_tools
+description: >
+  LangGraph StateGraph with multiple add_node calls — each node typically
+  binds its own tools. Even imperfect detection of LangGraph node-graph
+  construction is enough to suppress the capsule's META rule, since the
+  customer is clearly using the right idiom.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: python
+    rule:
+      any:
+        - pattern: $_.add_node($$$)
+        - pattern: StateGraph($$$)
+        - pattern: builder.add_node($$$)
+  - language: typescript
+    rule:
+      any:
+        - pattern: $_.addNode($$$)
+        - pattern: new StateGraph($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/per_sample_retrieval_diversification.yaml

@@ -0,0 +1,38 @@
+# Control: per_sample_retrieval_diversification
+# Referenced by:
+#   - prompting.self-consistency-no-isolation (META: none_of_controls)
+#
+# Different samples in a self-consistency loop pull from different
+# retrieval queries / different stores / different rerank seeds, instead
+# of all sharing the same RAG context.
+
+id: per_sample_retrieval_diversification
+description: >
+  When a self-consistency aggregator pulls retrieval per-sample from
+  varied queries (i.e. retrieval is INSIDE the per-sample lambda, not
+  hoisted above the loop). The shape is a .map over generation function
+  that itself contains a similaritySearch / vectorStore call.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      pattern: $_.similaritySearch($$$)
+      inside:
+        stopBy: end
+        any:
+          - pattern: $_.map($$$)
+          - kind: for_statement
+  - language: python
+    rule:
+      pattern: $_.similarity_search($$$)
+      inside:
+        stopBy: end
+        kind: for_statement
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/prisma_extension_or_middleware_attaching_org_filter.yaml

@@ -0,0 +1,31 @@
+# Control: prisma_extension_or_middleware_attaching_org_filter
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# A Prisma extension (or legacy $use middleware) that automatically appends
+# a where-clause scoping every query by org/tenant. When present, the
+# late-filter pattern is defense in depth, not the primary control.
+
+id: prisma_extension_or_middleware_attaching_org_filter
+description: >
+  Prisma client extension (post-5.x) or legacy $use middleware that injects
+  org/tenant scoping into every query. Detected by the call shape that
+  registers the extension/middleware referencing org_id, orgId, or tenant_id.
+
+applicable_languages:
+  - typescript
+  - javascript
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Modern Prisma client extension intercepting query operations
+        - pattern: "$_.$$extends({ query: $$$ })"
+        - pattern: "prisma.$$extends($$$)"
+        # Legacy Prisma middleware
+        - pattern: "$_.$$use($$$)"
+        - pattern: "prisma.$$use($$$)"
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/row_level_security_policy.yaml

@@ -0,0 +1,37 @@
+# Control: row_level_security_policy
+# Referenced by:
+#   - security.late-org-filter (META: none_of_controls)
+#
+# Detection of Postgres RLS policies in the codebase — either authored as
+# SQL migration text inside a string literal, or invoked via session GUC
+# setters that scope the connection by tenant.
+
+id: row_level_security_policy
+description: >
+  Postgres row-level security policy authored in the codebase, or session
+  GUCs that scope a connection by tenant for the duration of a request.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # SET LOCAL app.org_id pattern (per-request connection scoping)
+        - pattern: $_.$$queryRaw`SET LOCAL $$$`
+        - pattern: $_.$$executeRaw`SET LOCAL $$$`
+        # Common helpers
+        - pattern: setRlsContext($$$)
+        - pattern: setOrgContext($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: $_.execute("SET LOCAL $$$")
+        - pattern: set_rls_context($$$)
+        - pattern: set_org_context($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft

package/dist/pattern-packs/zivis-public-0.2.0/controls/source_attribution_present.yaml

@@ -0,0 +1,58 @@
+# Control: source_attribution_present
+# Referenced by:
+#   - retrieval.context-injection-no-validator (META: none_of_controls)
+#
+# A pattern where retrieved documents carry source-identifier metadata
+# the model is required to surface (citations) and / or the calling code
+# uses to apply access control after retrieval. Either flavor counts —
+# the point is that the corpus is not treated as an undifferentiated
+# trusted blob.
+
+id: source_attribution_present
+description: >
+  Retrieved documents carry source-identifier metadata that flows into
+  the prompt as required citations, OR into a post-retrieval access /
+  trust filter. Presence of either flavor is treated as evidence that
+  the corpus is not being treated as an undifferentiated trusted blob.
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+detection:
+  - language: typescript
+    rule:
+      any:
+        # Citation-style: doc IDs / sources embedded in prompt template
+        - pattern: $_.sourceId
+        - pattern: $_.source_id
+        - pattern: $_.citation
+        - pattern: $_.sourceUrl
+        - pattern: $_.documentId
+        # Post-retrieval access filter
+        - pattern: filterByAccess($$$)
+        - pattern: filterBySourceAccess($$$)
+        - pattern: filterRetrievedByPermission($$$)
+        - pattern: checkDocumentAccess($$$)
+        - pattern: assertSourceAllowed($$$)
+        # LangChain-style citation chains
+        - pattern: createCitationsChain($$$)
+        - pattern: new SourceAttributedRetrievalChain($$$)
+  - language: python
+    rule:
+      any:
+        - pattern: $_.source_id
+        - pattern: $_.citation
+        - pattern: $_.source_url
+        - pattern: $_.document_id
+        - pattern: filter_by_access($$$)
+        - pattern: filter_by_source_access($$$)
+        - pattern: filter_retrieved_by_permission($$$)
+        - pattern: check_document_access($$$)
+        - pattern: assert_source_allowed($$$)
+        # LangChain
+        - pattern: create_citations_chain($$$)
+
+owner: platform-threat-modeling
+lifecycle: draft