aws-security-mcp 0.6.3 → 0.7.1

package/dist/src/index.d.ts

@@ -19,6 +19,7 @@ interface Finding {
     module?: string;
     accountId?: string;
     accountAlias?: string;
+    source?: string;
 }
 interface ScanResult {
     module: string;

package/dist/src/index.js

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 // src/version.ts
-var VERSION = "0.6.3";
+var VERSION = "0.7.1";
 
 // src/utils/aws-client.ts
 import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";
@@ -1017,7 +1017,7 @@ async function dnsResolves(hostname) {
 var DnsDanglingScanner = class {
   moduleName = "dns_dangling";
   async scan(ctx) {
-    const { region, partition, accountId } = ctx;
+    const { region, partition } = ctx;
     const startMs = Date.now();
     const findings = [];
     const warnings = [];
@@ -2639,6 +2639,22 @@ import {
   SecurityHubClient as SecurityHubClient2,
   GetFindingsCommand
 } from "@aws-sdk/client-securityhub";
+
+// src/utils/sh-source.ts
+function getSecurityHubSource(finding) {
+  const impact = finding.impact ?? "";
+  const match = impact.match(/^Source:\s*([^(]+)/);
+  if (!match) return "Other";
+  const product = match[1].trim();
+  if (product === "Security Hub" || product.includes("Foundational")) return "FSBP";
+  if (product === "Inspector" || product.includes("Inspector")) return "Inspector";
+  if (product === "GuardDuty" || product.includes("GuardDuty")) return "GuardDuty";
+  if (product === "Config" || product.includes("Config")) return "Config";
+  if (product === "IAM Access Analyzer" || product.includes("Access Analyzer")) return "Access Analyzer";
+  return "Other";
+}
+
+// src/scanners/security-hub-findings.ts
 function shSeverityToScore(label) {
   switch (label) {
     case "CRITICAL":
@@ -2708,7 +2724,7 @@ var SecurityHubFindingsScanner = class {
           if (recText && !["See References", "None Provided", ""].includes(recText.trim())) {
             remediationSteps.push(recText);
           }
-          findings.push({
+          const finding = {
             severity,
             title: f.Title ?? "Security Hub Finding",
             resourceType,
@@ -2722,7 +2738,9 @@ var SecurityHubFindingsScanner = class {
             priority: priorityFromSeverity(severity),
             module: this.moduleName,
             accountId: f.AwsAccountId ?? accountId
-          });
+          };
+          finding.source = getSecurityHubSource(finding);
+          findings.push(finding);
         }
         nextToken = resp.NextToken;
       } while (nextToken);
@@ -7016,11 +7034,24 @@ function generateMlps3Report(scanResults, lang) {
 function esc(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+function safeUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.protocol === "https:" || u.protocol === "http:") return url;
+    return null;
+  } catch {
+    return null;
+  }
+}
 function escWithLinks(s) {
   const parts = s.split(/(https?:\/\/\S+)/);
   return parts.map((part, i) => {
     if (i % 2 === 1) {
-      return `<a href="${esc(part)}" style="color:#60a5fa" target="_blank" rel="noopener">${esc(part)}</a>`;
+      const safe = safeUrl(part);
+      if (safe) {
+        return `<a href="${esc(safe)}" style="color:#60a5fa" target="_blank" rel="noopener">${esc(part)}</a>`;
+      }
+      return esc(part);
     }
     return esc(part);
   }).join("");
@@ -7046,18 +7077,6 @@ var SEVERITY_ORDER2 = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
 function getRecommendationTemplate(rem) {
   return rem.replace(/\b(i-[0-9a-f]+)\b/g, "{instance}").replace(/\b(vol-[0-9a-f]+)\b/g, "{volume}").replace(/\b(sg-[0-9a-f]+)\b/g, "{sg}").replace(/\b(eipalloc-[0-9a-f]+)\b/g, "{eip}").replace(/\b(arn:aws[-\w]*:[^"\s]+)\b/g, "{arn}").replace(/"[^"]+"/g, "{name}").replace(/bucket \S+/g, "bucket {name}").replace(/instance \S+/g, "instance {id}").replace(/volume \S+/g, "volume {id}").replace(/rule \S+/g, "rule {name}");
 }
-function getSecurityHubSource(finding) {
-  const impact = finding.impact ?? "";
-  const match = impact.match(/^Source:\s*([^(]+)/);
-  if (!match) return "Other";
-  const product = match[1].trim();
-  if (product === "Security Hub" || product.includes("Foundational")) return "FSBP";
-  if (product === "Inspector" || product.includes("Inspector")) return "Inspector";
-  if (product === "GuardDuty" || product.includes("GuardDuty")) return "GuardDuty";
-  if (product === "Config" || product.includes("Config")) return "Config";
-  if (product === "IAM Access Analyzer" || product.includes("Access Analyzer")) return "Access Analyzer";
-  return "Other";
-}
 var SECURITY_HUB_SUB_CAT_ORDER = ["FSBP", "Inspector", "GuardDuty", "Config", "Access Analyzer", "Other"];
 function scoreColor(score) {
   if (score >= 80) return "#22c55e";
@@ -7253,6 +7272,7 @@ function sharedCss() {
     .filter-count{color:#64748b;font-size:13px;margin-left:auto}
     @media print{
       .filter-toolbar{display:none !important}
+      .finding-card,.module-fold{display:block !important}
       body{background:#fff;color:#1e293b;-webkit-print-color-adjust:exact;print-color-adjust:exact}
       .container{max-width:100%;padding:20px}
       .card,.score-card,.stat-card,.chart-box,.finding-fold,.top5-card,.trend-chart,.category-fold,.module-fold,.finding-card,.rec-fold{background:#fff;border:1px solid #e2e8f0}
@@ -7759,7 +7779,8 @@ ${rest}
     const renderRec = (r) => {
       const sev = r.severity.toLowerCase();
       const countLabel = r.count > 1 ? ` (&times; ${r.count})` : "";
-      const linkHtml = r.url ? ` <a href="${esc(r.url)}" style="color:#60a5fa" target="_blank" rel="noopener">&#128214;</a>` : "";
+      const safeLink = r.url ? safeUrl(r.url) : null;
+      const linkHtml = safeLink ? ` <a href="${esc(safeLink)}" style="color:#60a5fa" target="_blank" rel="noopener">&#128214;</a>` : "";
       return `<li><span class="badge badge-${esc(sev)}">${esc(r.severity)}</span> ${esc(r.text)}${countLabel}${linkHtml}</li>`;
     };
     const TOP_N = 10;
@@ -7795,7 +7816,8 @@ ${remaining.map(renderRec).join("\n")}
     document.querySelectorAll('.module-fold').forEach(function(f){
       var mod=f.getAttribute('data-module');
       if(activeMod!=='ALL'&&mod!==activeMod){f.style.display='none';return;}
-      f.style.display='';
+      var hasVisible=f.querySelectorAll('.finding-card:not([style*="display: none"])').length>0;
+      f.style.display=hasVisible?'':'none';
     });
     document.querySelectorAll('.severity-group-fold').forEach(function(g){
       g.style.display=g.querySelectorAll('.finding-card:not([style*="display: none"])').length?'':'none';
@@ -7917,7 +7939,6 @@ function generateMlps3HtmlReport(scanResults, history, lang) {
     </section>`;
   }
   const isEn = (lang ?? "zh") === "en";
-  const itemCat = (r) => isEn ? r.item.categoryEn : r.item.categoryCn;
   const itemControl = (r) => isEn ? r.item.controlEn : r.item.controlCn;
   const itemReq = (r) => isEn ? r.item.requirementEn : r.item.requirementCn;
   const categoryMap = /* @__PURE__ */ new Map();
@@ -8119,7 +8140,8 @@ ${itemsHtml}
       const renderMlpsRec = (r) => {
         const sev = r.severity.toLowerCase();
         const countLabel = r.count > 1 ? ` (&times; ${r.count})` : "";
-        const linkHtml = r.url ? ` <a href="${esc(r.url)}" style="color:#60a5fa" target="_blank" rel="noopener">&#128214;</a>` : "";
+        const safeLink = r.url ? safeUrl(r.url) : null;
+        const linkHtml = safeLink ? ` <a href="${esc(safeLink)}" style="color:#60a5fa" target="_blank" rel="noopener">&#128214;</a>` : "";
         return `<li><span class="badge badge-${esc(sev)}">${esc(r.severity)}</span> ${esc(r.text)}${countLabel}${linkHtml}</li>`;
       };
       const MLPS_TOP_N = 10;