agent-security-scanner-mcp 4.1.0 → 4.2.0

package/src/lib/compliance-evaluator.js

@@ -4,6 +4,131 @@ import { scoreBatch } from './aivss.js';
 
 const GRADE_ORDER = { A: 4, B: 3, C: 2, D: 1, F: 0 };
 
+/**
+ * Resolve a dot-path like "supply_chain.vulnerabilities.by_severity.critical" against an object.
+ * Returns undefined for any missing intermediate key (never throws).
+ */
+export function resolvePath(obj, path) {
+  if (obj == null || typeof path !== 'string') return undefined;
+  const segments = path.split('.');
+  let current = obj;
+  for (const seg of segments) {
+    if (current == null || typeof current !== 'object') return undefined;
+    current = current[seg];
+  }
+  return current;
+}
+
+/**
+ * Run a single evidence_check against the evidence bundle.
+ * Returns { passed: boolean, status: string|null, reason: string } where:
+ * - passed=true means check succeeded (no status change needed)
+ * - passed=false means on_fail status should be applied, with reason
+ */
+function runEvidenceCheck(check, evidenceBundle) {
+  const value = resolvePath(evidenceBundle, check.path);
+
+  // Missing evidence handling — three tiers:
+  //
+  // 1. Any node along the path is explicitly `null` → source failure → not_evaluated.
+  //    The evidence collector sets sections to null when a data source fails (e.g., OSV down).
+  //
+  // 2. A top-level section key is missing entirely (e.g., bundle has no "supply_chain") →
+  //    evidence was never collected → not_evaluated. Defaults must not mask this.
+  //
+  // 3. A deeper leaf is missing but its parent exists (e.g., scan.by_category_severity.crypto
+  //    is absent because no crypto findings) → safe to apply check.default.
+  //
+  if (value === undefined || value === null) {
+    const segments = check.path.split('.');
+
+    // Walk the path to find where it breaks
+    let current = evidenceBundle;
+    let depth = 0;
+    for (depth = 0; depth < segments.length; depth++) {
+      if (current === null) {
+        // Explicit null — source failure
+        const failedAt = segments.slice(0, depth).join('.') || segments[0];
+        return {
+          passed: false,
+          status: 'not_evaluated',
+          reason: `Evidence source unavailable: ${failedAt} is null (full path: ${check.path})`,
+        };
+      }
+      if (current === undefined || typeof current !== 'object') break;
+      const next = current[segments[depth]];
+      if (next === null) {
+        // Explicit null at this level
+        const failedAt = segments.slice(0, depth + 1).join('.');
+        return {
+          passed: false,
+          status: 'not_evaluated',
+          reason: `Evidence source unavailable: ${failedAt} is null (full path: ${check.path})`,
+        };
+      }
+      if (next === undefined) break; // missing key — check depth below
+      current = next;
+    }
+
+    // If the break happened at depth 0 or 1, the top-level section is missing.
+    // This means evidence was never collected — not_evaluated, no defaults.
+    if (depth <= 1) {
+      return {
+        passed: false,
+        status: 'not_evaluated',
+        reason: `Evidence source unavailable: ${segments[0]} is missing (full path: ${check.path})`,
+      };
+    }
+
+    // Break happened deeper — parent section exists, leaf key absent.
+    // Safe to apply default (e.g., scan ran but no "crypto" category).
+    if (check.default !== undefined) {
+      return evaluateOp(check.operator, check.default, check.value, check);
+    }
+
+    return {
+      passed: false,
+      status: 'not_evaluated',
+      reason: `Missing evidence at path: ${check.path}`,
+    };
+  }
+
+  return evaluateOp(check.operator, value, check.value, check);
+}
+
+function evaluateOp(operator, actual, expected, check) {
+  let passed;
+  switch (operator) {
+    case 'exists':
+      passed = actual !== undefined && actual !== null;
+      break;
+    case 'eq':
+      passed = actual === expected;
+      break;
+    case 'lte':
+      passed = typeof actual === 'number' && actual <= expected;
+      break;
+    case 'gte':
+      passed = typeof actual === 'number' && actual >= expected;
+      break;
+    default:
+      return { passed: false, status: 'not_evaluated', reason: `Unknown operator: ${operator}` };
+  }
+
+  if (passed) {
+    return { passed: true, status: null, reason: '' };
+  }
+
+  const status = check.on_fail || 'fail';
+  // Use distinct reason for not_evaluated vs failure to avoid confusing audit consumers.
+  // "reason" is the failure message; "not_evaluated_reason" explains why evidence was insufficient.
+  const reason = status === 'not_evaluated'
+    ? (check.not_evaluated_reason || `Evidence insufficient: ${check.path} ${operator} ${expected} (actual: ${actual})`)
+    : (check.reason || `Check failed: ${check.path} ${operator} ${expected} (actual: ${actual})`);
+
+  return { passed: false, status, reason };
+}
+
 /**
  * Check if actual grade is worse than threshold.
  * Missing/null grade → treated as F (worst case).
@@ -18,14 +143,11 @@ function gradeIsWorse(actual, threshold) {
  * Evaluate a single control against evidence.
  *
  * @param {object} control - A control from the registry
- * @param {object} evidence
- * @param {object|null} evidence.aivssPosture - Posture from scoreBatch, or null
- * @param {object[]} evidence.findings - Normalized findings from all available tools
- * @param {object} evidence.grades - Map of tool/scope → grade (e.g. { project: 'B' })
- * @param {string[]} evidence.toolsRun - Array of tool names whose output is available
+ * @param {object} evidence - Legacy evidence shape (aivssPosture, findings, grades, toolsRun)
+ * @param {object} [evidenceBundle] - Full evidence bundle for evidence_checks evaluation
  * @returns {{ control_id: string, status: string, reasons: string[] }}
  */
-export function evaluateControl(control, evidence) {
+export function evaluateControl(control, evidence, evidenceBundle) {
   if (!control || !control.id || !control.evaluation) {
     return {
       control_id: control?.id || 'unknown',
@@ -123,6 +245,24 @@ export function evaluateControl(control, evidence) {
     }
   }
 
+  // 7. Run evidence_checks (generic path-based checks, used by SOC2/GDPR controls)
+  if (Array.isArray(ev.evidence_checks) && evidenceBundle) {
+    for (const check of ev.evidence_checks) {
+      const result = runEvidenceCheck(check, evidenceBundle);
+      if (!result.passed) {
+        if (result.status === 'not_evaluated') {
+          // If we haven't already failed/passed via legacy checks, mark not_evaluated
+          if (status === 'pass') status = 'not_evaluated';
+        } else if (result.status === 'fail') {
+          status = 'fail';
+        } else if (result.status === 'partial' && status !== 'fail') {
+          status = 'partial';
+        }
+        if (result.reason) reasons.push(result.reason);
+      }
+    }
+  }
+
   return { control_id: control.id, status, reasons };
 }
 
@@ -130,11 +270,12 @@ export function evaluateControl(control, evidence) {
  * Evaluate all controls against evidence.
  *
  * @param {object[]} controls - Array of controls from registry
- * @param {object} evidence - Same shape as evaluateControl
+ * @param {object} evidence - Legacy evidence shape
+ * @param {object} [evidenceBundle] - Full evidence bundle for evidence_checks
  * @returns {{ controls_evaluated: number, pass: number, partial: number, fail: number, not_evaluated: number, results: object[] }}
  */
-export function evaluateAll(controls, evidence) {
-  const results = controls.map(c => evaluateControl(c, evidence));
+export function evaluateAll(controls, evidence, evidenceBundle) {
+  const results = controls.map(c => evaluateControl(c, evidence, evidenceBundle));
 
   const summary = { pass: 0, partial: 0, fail: 0, not_evaluated: 0 };
   for (const r of results) {

package/src/lib/compliance-evidence.js

@@ -0,0 +1,321 @@
+// src/lib/compliance-evidence.js — Collect normalized evidence bundle from scan + SBOM tooling.
+// Uses JS imports only — no CLI shelling, no HTML parsing.
+
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { scanProject } from '../tools/scan-project.js';
+import { normalizeFindings } from './normalize-finding.js';
+import { scoreBatch } from './aivss.js';
+import { discoverDependencies } from './lockfile-parsers.js';
+import { serialize } from './cyclonedx.js';
+import { componentFromBomComponent } from './sbom-component.js';
+import { queryBatch } from './osv-client.js';
+import { isHallucinated } from '../tools/check-package.js';
+import { ecosystemFromPurlType } from './purl.js';
+
+const HALLUCINATION_ECOSYSTEMS = new Set(['npm', 'pypi', 'rubygems', 'dart', 'perl', 'raku', 'crates']);
+const CATEGORY_DEFAULTS = [
+  'exfiltration', 'info-exposure', 'crypto', 'permissions', 'auth',
+  'prompt-injection', 'supply-chain', 'injection', 'xss', 'ssrf',
+  'deserialization', 'secrets', 'path-traversal', 'logging',
+];
+const SEVERITY_LEVELS = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];
+
+/**
+ * Build a compliance evidence bundle from a project directory.
+ *
+ * Collects scan results, SBOM data, vulnerability info, hallucination checks, and drift analysis.
+ * Each data source is collected independently — partial failures produce null sections, not aborts.
+ *
+ * @param {object} opts
+ * @param {string} opts.directory - Project root to scan
+ * @param {string} [opts.sbomPath] - Pre-existing SBOM file (skips discovery)
+ * @param {string} [opts.baselinePath] - SBOM baseline for drift comparison
+ * @param {string} [opts.toolVersion] - Scanner version for metadata
+ * @param {'minimal'|'compact'|'full'} [opts.verbosity='compact'] - Detail level
+ * @returns {Promise<object>} Evidence bundle
+ */
+export async function collectEvidence({ directory, sbomPath, baselinePath, toolVersion, verbosity = 'compact' }) {
+  const toolsRun = [];
+  const errors = [];
+
+  // --- 1. Scan project ---
+  let scanData = null;
+  try {
+    const result = await scanProject({ directory_path: directory, verbosity: 'full' });
+    const raw = JSON.parse(result.content[0].text);
+    scanData = raw;
+    toolsRun.push('scan_project', 'scan_security');
+  } catch (err) {
+    errors.push({ source: 'scan_project', message: err.message });
+  }
+
+  // --- 2. Normalize findings + AIVSS ---
+  // scan_project wraps scan_security — duplicate findings under both source_tools
+  // so AIUC-1 controls scoped to either tool see them correctly.
+  let normalized = [];
+  let aivssResult = null;
+  if (scanData) {
+    const base = normalizeFindings(scanData.issues || [], 'scan_security');
+    const duped = base.map(f => ({ ...f, source_tool: 'scan_project' }));
+    normalized = [...base, ...duped];
+    aivssResult = scoreBatch(base); // score deduplicated set
+  }
+
+  // --- 3. SBOM generation ---
+  let components = null;
+  let componentList = null;
+  let bom = null;
+  try {
+    if (sbomPath) {
+      // Explicit sbom_path: error if it doesn't exist (don't silently fall through)
+      if (!existsSync(sbomPath)) {
+        throw new Error(`SBOM file not found: ${sbomPath}`);
+      }
+      bom = JSON.parse(readFileSync(sbomPath, 'utf-8'));
+      components = (bom.components || []).map(componentFromBomComponent);
+    } else if (existsSync(directory)) {
+      componentList = discoverDependencies(directory);
+      components = componentList.components;
+      bom = serialize(componentList);
+    }
+    if (components) toolsRun.push('sbom_generate');
+  } catch (err) {
+    errors.push({ source: 'sbom_generate', message: err.message });
+  }
+
+  // --- 4. Vulnerability scan ---
+  let vulnData = null;
+  if (components && components.length > 0) {
+    try {
+      const cacheDir = directory ? join(directory, '.scanner', 'cache', 'vuln') : null;
+      const results = await queryBatch(components, { cacheDir });
+
+      const allVulns = [];
+      const affectedPackages = new Set();
+      const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 };
+
+      for (const [key, vulns] of results) {
+        for (const vuln of vulns) {
+          const level = vuln.ratings?.[0]?.severity || 'unknown';
+          allVulns.push(vuln);
+          affectedPackages.add(key);
+          bySeverity[level] = (bySeverity[level] || 0) + 1;
+        }
+      }
+
+      vulnData = {
+        total: allVulns.length,
+        affected_packages: affectedPackages.size,
+        by_severity: bySeverity,
+        vulnerabilities: allVulns,
+      };
+      toolsRun.push('sbom_scan_vulnerabilities');
+    } catch (err) {
+      errors.push({ source: 'sbom_scan_vulnerabilities', message: err.message });
+    }
+  }
+
+  // --- 5. Hallucination check ---
+  let hallucinationData = null;
+  if (components && components.length > 0) {
+    try {
+      const hallucinated = [];
+      const unsupported = [];
+      let legitimateCount = 0;
+
+      for (const comp of components) {
+        if (!HALLUCINATION_ECOSYSTEMS.has(comp.ecosystem)) {
+          unsupported.push({ name: comp.name, ecosystem: comp.ecosystem });
+          continue;
+        }
+        const result = isHallucinated(comp.name, comp.ecosystem);
+        if (result && result.hallucinated) {
+          hallucinated.push({ name: comp.name, ecosystem: comp.ecosystem, confidence: result.confidence || 'medium' });
+        } else {
+          legitimateCount++;
+        }
+      }
+
+      hallucinationData = {
+        hallucinated_count: hallucinated.length,
+        unsupported_count: unsupported.length,
+        legitimate_count: legitimateCount,
+        hallucinated_packages: hallucinated,
+        unsupported_packages: unsupported,
+      };
+      toolsRun.push('sbom_check_hallucinations');
+    } catch (err) {
+      errors.push({ source: 'sbom_check_hallucinations', message: err.message });
+    }
+  }
+
+  // --- 6. SBOM drift ---
+  let driftData = null;
+  if (bom) {
+    try {
+      const resolvedBaseline = baselinePath || join(directory, '.scanner', 'sbom-baseline.json');
+      const baselineExists = existsSync(resolvedBaseline);
+
+      if (baselineExists) {
+        const baselineBom = JSON.parse(readFileSync(resolvedBaseline, 'utf-8'));
+        const currentMap = buildComponentMap(bom.components || []);
+        const baselineMap = buildComponentMap(baselineBom.components || []);
+
+        let added = 0, removed = 0, versionChanged = 0;
+        for (const [key, comp] of currentMap) {
+          const baseComp = baselineMap.get(key);
+          if (!baseComp) added++;
+          else if (baseComp.version !== comp.version) versionChanged++;
+        }
+        for (const key of baselineMap.keys()) {
+          if (!currentMap.has(key)) removed++;
+        }
+
+        driftData = {
+          baseline_exists: true,
+          added,
+          removed,
+          version_changed: versionChanged,
+          summary: `+${added} added, -${removed} removed, ~${versionChanged} changed`,
+        };
+      } else {
+        driftData = { baseline_exists: false, added: 0, removed: 0, version_changed: 0, summary: '' };
+      }
+      toolsRun.push('sbom_diff');
+    } catch (err) {
+      errors.push({ source: 'sbom_diff', message: err.message });
+    }
+  }
+
+  // --- Build the evidence bundle ---
+  const grade = scanData?.grade || null;
+  const bySeverity = buildSeverityMap(normalized);
+  const byCategory = buildCategoryMap(normalized);
+  const byCategorySeverity = buildCategorySeverityMap(normalized);
+
+  const bundle = {
+    metadata: {
+      generated_at: new Date().toISOString(),
+      directory,
+      tool_version: toolVersion || 'unknown',
+    },
+    tools_run: [...new Set(toolsRun)],
+    errors: errors.length > 0 ? errors : undefined,
+    scan: scanData ? {
+      grade,
+      findings: normalized,
+      by_severity: bySeverity,
+      by_category: byCategory,
+      by_category_severity: byCategorySeverity,
+    } : null,
+    aivss: aivssResult ? {
+      posture: aivssResult.posture,
+      findings: aivssResult.findings,
+    } : null,
+    sbom: components ? {
+      component_count: components.length,
+      ecosystems: [...new Set(components.map(c => c.ecosystem))],
+      direct_count: components.filter(c => c.isDirect).length,
+      dev_count: components.filter(c => c.isDev).length,
+      bom: verbosity === 'full' ? bom : undefined,
+    } : null,
+    supply_chain: {
+      vulnerabilities: vulnData ? {
+        total: vulnData.total,
+        affected_packages: vulnData.affected_packages,
+        by_severity: vulnData.by_severity,
+        vulnerabilities: verbosity === 'full' ? vulnData.vulnerabilities : undefined,
+      } : null,
+      hallucinations: hallucinationData ? {
+        hallucinated_count: hallucinationData.hallucinated_count,
+        unsupported_count: hallucinationData.unsupported_count,
+        legitimate_count: hallucinationData.legitimate_count,
+        hallucinated_packages: hallucinationData.hallucinated_packages,
+        unsupported_packages: hallucinationData.unsupported_packages,
+      } : null,
+      drift: driftData,
+    },
+  };
+
+  return bundle;
+}
+
+/**
+ * Build the legacy-compatible evidence object for the compliance evaluator.
+ * This converts the evidence bundle into the shape expected by evaluateControl/evaluateAll.
+ */
+export function buildEvaluatorEvidence(bundle) {
+  const grade = bundle.scan?.grade || null;
+  return {
+    aivssPosture: bundle.aivss?.posture || null,
+    findings: bundle.scan?.findings || [],
+    grades: { scan_project: grade, scan_security: grade, project: grade },
+    toolsRun: bundle.tools_run,
+  };
+}
+
+// --- Internal helpers ---
+
+function buildSeverityMap(findings) {
+  const map = {};
+  for (const level of SEVERITY_LEVELS) map[level] = 0;
+  for (const f of findings) {
+    if (f.source_tool === 'scan_project') continue; // avoid double-counting
+    const sev = f.severity || 'INFO';
+    map[sev] = (map[sev] || 0) + 1;
+  }
+  return map;
+}
+
+function buildCategoryMap(findings) {
+  const map = {};
+  for (const cat of CATEGORY_DEFAULTS) map[cat] = 0;
+  for (const f of findings) {
+    if (f.source_tool === 'scan_project') continue;
+    const cat = f.category || 'unknown';
+    map[cat] = (map[cat] || 0) + 1;
+  }
+  return map;
+}
+
+function buildCategorySeverityMap(findings) {
+  const map = {};
+  for (const cat of CATEGORY_DEFAULTS) {
+    map[cat] = {};
+    for (const sev of SEVERITY_LEVELS) map[cat][sev] = 0;
+  }
+  for (const f of findings) {
+    if (f.source_tool === 'scan_project') continue;
+    const cat = f.category || 'unknown';
+    const sev = f.severity || 'INFO';
+    if (!map[cat]) {
+      map[cat] = {};
+      for (const s of SEVERITY_LEVELS) map[cat][s] = 0;
+    }
+    map[cat][sev] = (map[cat][sev] || 0) + 1;
+  }
+  return map;
+}
+
+function buildComponentMap(components) {
+  const map = new Map();
+  for (const comp of components) {
+    const eco = extractEcosystem(comp);
+    const key = `${eco}:${comp.name}`;
+    map.set(key, comp);
+  }
+  return map;
+}
+
+function extractEcosystem(component) {
+  if (component.properties) {
+    const eco = component.properties.find(p => p.name === 'cdx:ecosystem');
+    if (eco) return eco.value;
+  }
+  if (component.purl) {
+    const match = component.purl.match(/^pkg:([^/]+)/);
+    if (match) return ecosystemFromPurlType(match[1]);
+  }
+  return component.ecosystem || 'unknown';
+}

package/src/lib/cyclonedx.js

@@ -0,0 +1,113 @@
+// CycloneDX v1.5 JSON serializer.
+// Consumes the normalized ComponentList model from sbom-component.js.
+
+import { randomUUID } from 'crypto';
+
+const SPEC_VERSION = '1.5';
+const TOOL_NAME = 'agent-security-scanner-mcp';
+
+/**
+ * Serialize a ComponentList into a CycloneDX v1.5 BOM.
+ * @param {import('./sbom-component.js').ComponentList} componentList
+ * @param {object[]} [vulnerabilities=[]]
+ * @param {{ toolVersion?: string }} [options={}]
+ * @returns {object} CycloneDX JSON object
+ */
+export function serialize(componentList, vulnerabilities = [], options = {}) {
+  const { toolVersion = '0.0.0' } = options;
+  const { components, edges, metadata } = componentList;
+
+  const bom = {
+    bomFormat: 'CycloneDX',
+    specVersion: SPEC_VERSION,
+    serialNumber: `urn:uuid:${randomUUID()}`,
+    version: 1,
+    metadata: {
+      timestamp: new Date().toISOString(),
+      tools: [{
+        name: TOOL_NAME,
+        version: toolVersion,
+      }],
+      component: {
+        type: 'application',
+        name: metadata.name || 'unknown',
+        version: metadata.version || '0.0.0',
+        'bom-ref': `pkg:npm/${metadata.name}@${metadata.version}`,
+      },
+    },
+    components: components.map(c => serializeComponent(c)),
+    dependencies: serializeDependencies(edges, components),
+  };
+
+  if (vulnerabilities.length > 0) {
+    bom.vulnerabilities = vulnerabilities;
+  }
+
+  return bom;
+}
+
+function serializeComponent(component) {
+  const result = {
+    type: 'library',
+    name: component.name,
+    version: component.version,
+    purl: component.purl,
+    'bom-ref': component.purl,
+    scope: component.scope === 'optional' ? 'optional' : 'required',
+  };
+
+  if (component.namespace) {
+    result.group = component.namespace;
+  }
+
+  const properties = [];
+  if (component.isDev) {
+    properties.push({ name: 'cdx:development', value: 'true' });
+  }
+  if (component.ecosystem) {
+    properties.push({ name: 'cdx:ecosystem', value: component.ecosystem });
+  }
+  if (properties.length > 0) {
+    result.properties = properties;
+  }
+
+  return result;
+}
+
+function serializeDependencies(edges, components) {
+  if (!edges || edges.length === 0) {
+    // Return flat list — each component depends on nothing
+    return components.map(c => ({ ref: c.purl, dependsOn: [] }));
+  }
+
+  // Group edges by source
+  const depMap = new Map();
+  for (const edge of edges) {
+    if (!depMap.has(edge.from)) depMap.set(edge.from, []);
+    depMap.get(edge.from).push(edge.to);
+  }
+
+  // Include all components as refs, merge edges
+  const allRefs = new Set(components.map(c => c.purl));
+  for (const [from, tos] of depMap) {
+    allRefs.add(from);
+    for (const to of tos) allRefs.add(to);
+  }
+
+  return [...allRefs].map(ref => ({
+    ref,
+    dependsOn: depMap.get(ref) || [],
+  }));
+}
+
+/**
+ * Add vulnerability entries to an existing BOM.
+ * @param {object} bom - CycloneDX BOM object
+ * @param {object[]} vulnerabilities - Array of CycloneDX vulnerability objects
+ * @returns {object} The mutated BOM
+ */
+export function addVulnerabilities(bom, vulnerabilities) {
+  if (!bom.vulnerabilities) bom.vulnerabilities = [];
+  bom.vulnerabilities.push(...vulnerabilities);
+  return bom;
+}