defense-mcp-server 0.6.0

package/build/tools/drift-detection.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Drift detection tools.
+ *
+ * Registers 1 tool: drift_baseline (actions: create, compare, list).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerDriftDetectionTools(server: McpServer): void;
+//# sourceMappingURL=drift-detection.d.ts.map

package/build/tools/drift-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-detection.d.ts","sourceRoot":"","sources":["../../src/tools/drift-detection.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAwFpE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAkSnE"}

package/build/tools/drift-detection.js

@@ -0,0 +1,326 @@
+/**
+ * Drift detection tools.
+ *
+ * Registers 1 tool: drift_baseline (actions: create, compare, list).
+ */
+import { z } from "zod";
+import { executeCommand } from "../core/executor.js";
+import { createErrorContent, formatToolOutput } from "../core/parsers.js";
+import { existsSync, readFileSync, mkdirSync, readdirSync, statSync } from "node:fs";
+import { join, extname, resolve } from "node:path";
+import { homedir } from "node:os";
+import { createHash } from "node:crypto";
+import { secureWriteFileSync } from "../core/secure-fs.js";
+const BASELINE_DIR = join(homedir(), ".kali-mcp-baselines");
+// ── TOOL-024 remediation: baseline path validation ─────────────────────────
+/** Allowed directories for drift baseline files */
+const ALLOWED_BASELINE_DIRS = [BASELINE_DIR, "/tmp", "/var/lib", "/home", "/root", "/opt"];
+/** Allowed file extensions for baseline files */
+const ALLOWED_BASELINE_EXTENSIONS = new Set([".json", ".yaml", ".yml"]);
+/**
+ * Validate a baseline file path:
+ * 1. Reject `..` sequences
+ * 2. Resolve and verify within allowed directories
+ * 3. Validate file extension
+ */
+function validateBaselinePath(inputPath) {
+    if (!inputPath || typeof inputPath !== "string") {
+        throw new Error("Baseline path must be a non-empty string");
+    }
+    if (inputPath.includes("..")) {
+        throw new Error(`Baseline path contains forbidden traversal sequence (..): '${inputPath}'`);
+    }
+    const resolved = resolve(inputPath);
+    const isAllowed = ALLOWED_BASELINE_DIRS.some((dir) => resolved === dir || resolved.startsWith(dir + "/"));
+    if (!isAllowed) {
+        throw new Error(`Baseline path '${resolved}' is not within allowed directories: ${ALLOWED_BASELINE_DIRS.join(", ")}`);
+    }
+    const ext = extname(resolved).toLowerCase();
+    if (ext && !ALLOWED_BASELINE_EXTENSIONS.has(ext)) {
+        throw new Error(`Baseline file has invalid extension '${ext}'. Allowed: ${[...ALLOWED_BASELINE_EXTENSIONS].join(", ")}`);
+    }
+    return resolved;
+}
+function ensureBaselineDir() {
+    if (!existsSync(BASELINE_DIR)) {
+        mkdirSync(BASELINE_DIR, { recursive: true });
+    }
+}
+function hashFile(filePath) {
+    try {
+        const content = readFileSync(filePath);
+        return createHash("sha256").update(content).digest("hex");
+    }
+    catch {
+        return "unreadable";
+    }
+}
+export function registerDriftDetectionTools(server) {
+    server.tool("drift_baseline", "Drift detection: create system baselines, compare current state against baselines, or list available baselines.", {
+        action: z.enum(["create", "compare", "list"]).describe("Action: create=create baseline, compare=compare against baseline, list=list baselines"),
+        // create/compare params
+        name: z.string().optional().default("default").describe("Baseline name"),
+        directories: z.array(z.string()).optional().default(["/etc"]).describe("Directories to hash (create action)"),
+        // shared
+        dryRun: z.boolean().optional().default(true).describe("Preview only"),
+    }, async (params) => {
+        const { action } = params;
+        switch (action) {
+            // ── create ──────────────────────────────────────────────────
+            case "create": {
+                const { directories, name, dryRun } = params;
+                try {
+                    ensureBaselineDir();
+                    if (dryRun) {
+                        return {
+                            content: [formatToolOutput({
+                                    dryRun: true,
+                                    directories,
+                                    baselineName: name,
+                                    storagePath: join(BASELINE_DIR, `${name}.json`),
+                                })],
+                        };
+                    }
+                    // Hash files in directories
+                    const files = [];
+                    for (const dir of directories) {
+                        if (!existsSync(dir))
+                            continue;
+                        const findResult = await executeCommand({
+                            command: "find",
+                            args: [dir, "-maxdepth", "3", "-type", "f", "-not", "-path", "*/proc/*", "-not", "-path", "*/sys/*"],
+                            timeout: 30000,
+                        });
+                        // find may return non-zero due to permission errors but still output valid paths
+                        if (findResult.stdout.trim()) {
+                            const paths = findResult.stdout.trim().split("\n").filter(Boolean).slice(0, 5000);
+                            for (const p of paths) {
+                                try {
+                                    const stat = statSync(p);
+                                    files.push({
+                                        path: p,
+                                        hash: hashFile(p),
+                                        size: stat.size,
+                                        mtime: stat.mtime.toISOString(),
+                                    });
+                                }
+                                catch { /* skip unreadable */ }
+                            }
+                        }
+                    }
+                    // Capture sysctl state
+                    const sysctlState = {};
+                    const sysctlResult = await executeCommand({
+                        command: "sysctl",
+                        args: ["-a"],
+                        timeout: 10000,
+                    });
+                    if (sysctlResult.exitCode === 0 && sysctlResult.stdout.trim()) {
+                        for (const line of sysctlResult.stdout.split("\n")) {
+                            const idx = line.indexOf("=");
+                            if (idx > 0) {
+                                sysctlState[line.substring(0, idx).trim()] = line.substring(idx + 1).trim();
+                            }
+                        }
+                    }
+                    // Fallback: read key sysctl values from /proc/sys/ if sysctl binary failed or returned nothing
+                    if (Object.keys(sysctlState).length === 0) {
+                        const procSysKeys = [
+                            ["net.ipv4.ip_forward", "/proc/sys/net/ipv4/ip_forward"],
+                            ["net.ipv4.conf.all.accept_redirects", "/proc/sys/net/ipv4/conf/all/accept_redirects"],
+                            ["net.ipv4.conf.all.send_redirects", "/proc/sys/net/ipv4/conf/all/send_redirects"],
+                            ["net.ipv4.conf.all.accept_source_route", "/proc/sys/net/ipv4/conf/all/accept_source_route"],
+                            ["net.ipv4.conf.all.log_martians", "/proc/sys/net/ipv4/conf/all/log_martians"],
+                            ["net.ipv4.icmp_echo_ignore_broadcasts", "/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts"],
+                            ["net.ipv4.tcp_syncookies", "/proc/sys/net/ipv4/tcp_syncookies"],
+                            ["net.ipv6.conf.all.accept_redirects", "/proc/sys/net/ipv6/conf/all/accept_redirects"],
+                            ["net.ipv6.conf.all.accept_source_route", "/proc/sys/net/ipv6/conf/all/accept_source_route"],
+                            ["kernel.randomize_va_space", "/proc/sys/kernel/randomize_va_space"],
+                            ["kernel.dmesg_restrict", "/proc/sys/kernel/dmesg_restrict"],
+                            ["kernel.kptr_restrict", "/proc/sys/kernel/kptr_restrict"],
+                            ["kernel.yama.ptrace_scope", "/proc/sys/kernel/yama/ptrace_scope"],
+                            ["kernel.sysrq", "/proc/sys/kernel/sysrq"],
+                            ["fs.protected_hardlinks", "/proc/sys/fs/protected_hardlinks"],
+                            ["fs.protected_symlinks", "/proc/sys/fs/protected_symlinks"],
+                            ["fs.suid_dumpable", "/proc/sys/fs/suid_dumpable"],
+                        ];
+                        for (const [key, procPath] of procSysKeys) {
+                            try {
+                                if (existsSync(procPath)) {
+                                    const val = readFileSync(procPath, "utf-8").trim();
+                                    sysctlState[key] = val;
+                                }
+                            }
+                            catch { /* skip unreadable */ }
+                        }
+                        if (Object.keys(sysctlState).length > 0) {
+                            console.error(`[drift-detection] sysctl binary unavailable; read ${Object.keys(sysctlState).length} keys from /proc/sys/`);
+                        }
+                        else {
+                            console.error("[drift-detection] Warning: could not capture any sysctl state (sysctl binary unavailable and /proc/sys/ read failed)");
+                        }
+                    }
+                    // Capture service states
+                    const services = {};
+                    const svcResult = await executeCommand({
+                        command: "systemctl",
+                        args: ["list-units", "--type=service", "--no-pager", "--plain", "--no-legend"],
+                        timeout: 10000,
+                    });
+                    if (svcResult.exitCode === 0) {
+                        for (const line of svcResult.stdout.split("\n")) {
+                            const parts = line.trim().split(/\s+/);
+                            if (parts.length >= 3) {
+                                services[parts[0]] = parts[2]; // active/inactive/failed
+                            }
+                        }
+                    }
+                    const baseline = {
+                        id: name,
+                        timestamp: new Date().toISOString(),
+                        directories,
+                        files,
+                        sysctlState,
+                        services,
+                    };
+                    const outPath = join(BASELINE_DIR, `${name}.json`);
+                    // TOOL-024: Validate baseline output path and use secure write
+                    validateBaselinePath(outPath);
+                    secureWriteFileSync(outPath, JSON.stringify(baseline, null, 2), "utf-8");
+                    return {
+                        content: [formatToolOutput({
+                                baselineName: name,
+                                timestamp: baseline.timestamp,
+                                filesHashed: files.length,
+                                sysctlKeys: Object.keys(sysctlState).length,
+                                servicesTracked: Object.keys(services).length,
+                                savedTo: outPath,
+                            })],
+                    };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`Baseline creation failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            // ── compare ─────────────────────────────────────────────────
+            case "compare": {
+                const { name, dryRun } = params;
+                try {
+                    const baselinePath = join(BASELINE_DIR, `${name}.json`);
+                    // TOOL-024: Validate baseline path before reading
+                    validateBaselinePath(baselinePath);
+                    if (!existsSync(baselinePath)) {
+                        return { content: [createErrorContent(`Baseline '${name}' not found at ${baselinePath}`)], isError: true };
+                    }
+                    const baseline = JSON.parse(readFileSync(baselinePath, "utf-8"));
+                    const fileChanges = [];
+                    const sysctlChanges = [];
+                    const serviceChanges = [];
+                    // Compare files
+                    for (const entry of baseline.files.slice(0, 2000)) {
+                        if (!existsSync(entry.path)) {
+                            fileChanges.push({ path: entry.path, type: "deleted", detail: "File no longer exists" });
+                            continue;
+                        }
+                        const currentHash = hashFile(entry.path);
+                        if (currentHash !== entry.hash && currentHash !== "unreadable") {
+                            fileChanges.push({ path: entry.path, type: "modified", detail: `hash changed: ${entry.hash.slice(0, 12)}... → ${currentHash.slice(0, 12)}...` });
+                        }
+                    }
+                    // Compare sysctl
+                    const sysctlResult = await executeCommand({
+                        command: "sysctl",
+                        args: ["-a"],
+                        timeout: 10000,
+                    });
+                    if (sysctlResult.exitCode === 0) {
+                        const currentSysctl = {};
+                        for (const line of sysctlResult.stdout.split("\n")) {
+                            const idx = line.indexOf("=");
+                            if (idx > 0) {
+                                currentSysctl[line.substring(0, idx).trim()] = line.substring(idx + 1).trim();
+                            }
+                        }
+                        for (const [key, val] of Object.entries(baseline.sysctlState)) {
+                            const current = currentSysctl[key];
+                            if (current !== undefined && current !== val) {
+                                sysctlChanges.push({ key, baseline: val, current });
+                            }
+                        }
+                    }
+                    // Compare services
+                    const svcResult = await executeCommand({
+                        command: "systemctl",
+                        args: ["list-units", "--type=service", "--no-pager", "--plain", "--no-legend"],
+                        timeout: 10000,
+                    });
+                    if (svcResult.exitCode === 0) {
+                        const currentServices = {};
+                        for (const line of svcResult.stdout.split("\n")) {
+                            const parts = line.trim().split(/\s+/);
+                            if (parts.length >= 3) {
+                                currentServices[parts[0]] = parts[2];
+                            }
+                        }
+                        for (const [svc, state] of Object.entries(baseline.services)) {
+                            const current = currentServices[svc];
+                            if (current !== undefined && current !== state) {
+                                serviceChanges.push({ service: svc, baseline: state, current });
+                            }
+                        }
+                    }
+                    const totalDrifts = fileChanges.length + sysctlChanges.length + serviceChanges.length;
+                    return {
+                        content: [formatToolOutput({
+                                baselineName: name,
+                                baselineTimestamp: baseline.timestamp,
+                                comparedAt: new Date().toISOString(),
+                                totalDrifts,
+                                fileChanges: fileChanges.slice(0, 50),
+                                sysctlChanges: sysctlChanges.slice(0, 50),
+                                serviceChanges: serviceChanges.slice(0, 50),
+                                status: totalDrifts === 0 ? "NO_DRIFT" : "DRIFT_DETECTED",
+                            })],
+                    };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`Baseline comparison failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            // ── list ────────────────────────────────────────────────────
+            case "list": {
+                try {
+                    ensureBaselineDir();
+                    const files = readdirSync(BASELINE_DIR).filter((f) => f.endsWith(".json") && f !== "manifest.json");
+                    const baselines = files.map((f) => {
+                        try {
+                            const data = JSON.parse(readFileSync(join(BASELINE_DIR, f), "utf-8"));
+                            return {
+                                name: data.id,
+                                timestamp: data.timestamp,
+                                filesTracked: data.files.length,
+                                sysctlKeys: Object.keys(data.sysctlState).length,
+                                services: Object.keys(data.services).length,
+                            };
+                        }
+                        catch {
+                            return { name: f, timestamp: "unknown", filesTracked: 0, sysctlKeys: 0, services: 0 };
+                        }
+                    });
+                    return {
+                        content: [formatToolOutput({
+                                baselineDir: BASELINE_DIR,
+                                totalBaselines: baselines.length,
+                                baselines,
+                            })],
+                    };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`Drift listing failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            default:
+                return { content: [createErrorContent(`Unknown action: ${action}`)], isError: true };
+        }
+    });
+}

package/build/tools/ebpf-security.d.ts

@@ -0,0 +1,15 @@
+/**
+ * eBPF and Falco security tools.
+ *
+ * Registers 2 tools: list_ebpf_programs, falco (actions: status, deploy_rules, events).
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * Validate a BPF filter expression.
+ * Rejects shell metacharacters, enforces length limits, and allows only
+ * safe characters (alphanumeric, spaces, dots, colons, slashes, hyphens,
+ * underscores, brackets, comparison operators, and quotes).
+ */
+export declare function validateBpfFilter(filter: string): string;
+export declare function registerEbpfSecurityTools(server: McpServer): void;
+//# sourceMappingURL=ebpf-security.d.ts.map

package/build/tools/ebpf-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ebpf-security.d.ts","sourceRoot":"","sources":["../../src/tools/ebpf-security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqBpE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA0BxD;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwRjE"}

package/build/tools/ebpf-security.js

@@ -0,0 +1,294 @@
+/**
+ * eBPF and Falco security tools.
+ *
+ * Registers 2 tools: list_ebpf_programs, falco (actions: status, deploy_rules, events).
+ */
+import { z } from "zod";
+import { executeCommand } from "../core/executor.js";
+import { createErrorContent, formatToolOutput } from "../core/parsers.js";
+import { logChange, createChangeEntry } from "../core/changelog.js";
+import { SafeguardRegistry } from "../core/safeguards.js";
+import { existsSync, mkdirSync } from "node:fs";
+import { secureWriteFileSync } from "../core/secure-fs.js";
+// ── TOOL-018 remediation: BPF filter expression validation ─────────────────
+/** Characters allowed in BPF filter expressions */
+const BPF_FILTER_ALLOWED_RE = /^[a-zA-Z0-9\s.\/:_\-\[\]!=<>'"]+$/;
+/** Shell metacharacters that must be rejected in BPF filters */
+const BPF_SHELL_METACHAR_RE = /[;|&`$(){}<>]/;
+/** Maximum BPF filter expression length */
+const BPF_FILTER_MAX_LENGTH = 500;
+/**
+ * Validate a BPF filter expression.
+ * Rejects shell metacharacters, enforces length limits, and allows only
+ * safe characters (alphanumeric, spaces, dots, colons, slashes, hyphens,
+ * underscores, brackets, comparison operators, and quotes).
+ */
+export function validateBpfFilter(filter) {
+    if (!filter || typeof filter !== "string") {
+        throw new Error("BPF filter must be a non-empty string");
+    }
+    const trimmed = filter.trim();
+    if (trimmed.length > BPF_FILTER_MAX_LENGTH) {
+        throw new Error(`BPF filter expression too long (${trimmed.length} chars). Maximum is ${BPF_FILTER_MAX_LENGTH} characters.`);
+    }
+    if (BPF_SHELL_METACHAR_RE.test(trimmed)) {
+        throw new Error(`BPF filter contains forbidden shell metacharacters: '${trimmed}'`);
+    }
+    if (!BPF_FILTER_ALLOWED_RE.test(trimmed)) {
+        throw new Error(`BPF filter contains invalid characters. Only alphanumeric, spaces, dots, colons, slashes, hyphens, underscores, brackets, comparison operators, and quotes are allowed.`);
+    }
+    return trimmed;
+}
+export function registerEbpfSecurityTools(server) {
+    // ── list_ebpf_programs (kept as-is) ────────────────────────────────────────
+    server.tool("ebpf_list_programs", "List loaded eBPF programs and pinned maps.", {
+        dryRun: z.boolean().optional().default(true).describe("Preview only"),
+    }, async ({ dryRun }) => {
+        try {
+            const results = {};
+            // List BPF filesystem
+            if (existsSync("/sys/fs/bpf")) {
+                const ls = await executeCommand({
+                    command: "ls",
+                    args: ["-la", "/sys/fs/bpf"],
+                    timeout: 5000,
+                });
+                results.bpfFs = ls.stdout.trim().split("\n");
+            }
+            else {
+                results.bpfFs = "Not mounted";
+            }
+            // Try bpftool
+            const bpftool = await executeCommand({
+                command: "bpftool",
+                args: ["prog", "list", "--json"],
+                timeout: 10000,
+            });
+            if (bpftool.exitCode === 0) {
+                try {
+                    results.programs = JSON.parse(bpftool.stdout);
+                }
+                catch {
+                    results.programs = bpftool.stdout.split("\n").filter(Boolean);
+                }
+            }
+            else {
+                // Fallback to non-JSON
+                const fallback = await executeCommand({
+                    command: "bpftool",
+                    args: ["prog", "list"],
+                    timeout: 10000,
+                });
+                results.programs = fallback.exitCode === 0
+                    ? fallback.stdout.split("\n").filter(Boolean)
+                    : "bpftool not available or insufficient permissions";
+            }
+            // List maps
+            const maps = await executeCommand({
+                command: "bpftool",
+                args: ["map", "list", "--json"],
+                timeout: 10000,
+            });
+            if (maps.exitCode === 0) {
+                try {
+                    results.maps = JSON.parse(maps.stdout);
+                }
+                catch {
+                    results.maps = maps.stdout.split("\n").filter(Boolean);
+                }
+            }
+            return { content: [formatToolOutput(results)] };
+        }
+        catch (err) {
+            return { content: [createErrorContent(`eBPF listing failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+        }
+    });
+    // ── falco (merged: check_falco + deploy_falco_rules + get_ebpf_events) ────
+    server.tool("ebpf_falco", "Falco runtime security: check status, deploy custom rules, or read recent events.", {
+        action: z.enum(["status", "deploy_rules", "events"]).describe("Action: status=check Falco, deploy_rules=deploy custom rules, events=read recent events"),
+        // deploy_rules params
+        ruleName: z.string().optional().describe("Rule file name without .yaml extension (deploy_rules action)"),
+        ruleContent: z.string().optional().describe("YAML rule content (deploy_rules action)"),
+        // events params
+        lines: z.number().optional().default(50).describe("Number of recent events to return (events action)"),
+        priority: z.enum(["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"]).optional().describe("Filter by minimum priority (events action)"),
+        // shared
+        dryRun: z.boolean().optional().default(true).describe("Preview only"),
+    }, async (params) => {
+        const { action } = params;
+        switch (action) {
+            // ── status ──────────────────────────────────────────────────
+            case "status": {
+                try {
+                    const info = {};
+                    // Check if falco is installed
+                    const which = await executeCommand({ command: "which", args: ["falco"], timeout: 5000 });
+                    info.installed = which.exitCode === 0;
+                    if (!info.installed) {
+                        return {
+                            content: [formatToolOutput({
+                                    installed: false,
+                                    message: "Falco not installed. Install from https://falco.org/docs/install-operate/installation/",
+                                })],
+                        };
+                    }
+                    // Version
+                    const version = await executeCommand({ command: "falco", args: ["--version"], timeout: 5000 });
+                    info.version = version.stdout.trim();
+                    // Service status
+                    const status = await executeCommand({
+                        command: "systemctl",
+                        args: ["status", "falco", "--no-pager"],
+                        timeout: 10000,
+                    });
+                    info.serviceStatus = status.stdout.trim().split("\n").slice(0, 10);
+                    info.active = status.stdout.includes("active (running)");
+                    // Check config
+                    if (existsSync("/etc/falco/falco.yaml")) {
+                        info.configExists = true;
+                    }
+                    // Check custom rules
+                    if (existsSync("/etc/falco/rules.d")) {
+                        const ls = await executeCommand({ command: "ls", args: ["/etc/falco/rules.d"], timeout: 5000 });
+                        info.customRules = ls.stdout.trim().split("\n").filter(Boolean);
+                    }
+                    return { content: [formatToolOutput(info)] };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`Falco check failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            // ── deploy_rules ────────────────────────────────────────────
+            case "deploy_rules": {
+                const { ruleName, ruleContent, dryRun } = params;
+                try {
+                    if (!ruleName) {
+                        return { content: [createErrorContent("ruleName is required for deploy_rules action")], isError: true };
+                    }
+                    if (!ruleContent) {
+                        return { content: [createErrorContent("ruleContent is required for deploy_rules action")], isError: true };
+                    }
+                    const safety = await SafeguardRegistry.getInstance().checkSafety("deploy_falco_rules", { ruleName });
+                    const rulesDir = "/etc/falco/rules.d";
+                    const rulePath = `${rulesDir}/${ruleName}.yaml`;
+                    if (dryRun) {
+                        return {
+                            content: [formatToolOutput({
+                                    dryRun: true,
+                                    rulePath,
+                                    ruleContent,
+                                    warnings: safety.warnings,
+                                    restartCommand: "systemctl restart falco",
+                                })],
+                        };
+                    }
+                    if (!existsSync(rulesDir)) {
+                        mkdirSync(rulesDir, { recursive: true });
+                    }
+                    // TOOL-010: Use secure-fs instead of direct writeFileSync for audit trail
+                    secureWriteFileSync(rulePath, ruleContent, "utf-8");
+                    // Validate rules
+                    const validate = await executeCommand({
+                        command: "falco",
+                        args: ["--validate", rulePath],
+                        timeout: 15000,
+                    });
+                    const entry = createChangeEntry({
+                        tool: "ebpf_falco",
+                        action: `Deploy Falco rule ${ruleName}`,
+                        target: rulePath,
+                        dryRun: false,
+                        success: validate.exitCode === 0,
+                        rollbackCommand: `rm ${rulePath}`,
+                    });
+                    logChange(entry);
+                    return {
+                        content: [formatToolOutput({
+                                success: validate.exitCode === 0,
+                                rulePath,
+                                validated: validate.exitCode === 0,
+                                validationOutput: validate.stdout || validate.stderr,
+                                nextStep: "systemctl restart falco",
+                            })],
+                    };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`Falco rule deployment failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            // ── events ──────────────────────────────────────────────────
+            case "events": {
+                const { lines, priority } = params;
+                try {
+                    const logPaths = [
+                        "/var/log/falco/falco_events.json",
+                        "/var/log/falco/events.json",
+                        "/var/log/falco.log",
+                    ];
+                    let logPath = null;
+                    for (const p of logPaths) {
+                        if (existsSync(p)) {
+                            logPath = p;
+                            break;
+                        }
+                    }
+                    if (!logPath) {
+                        // Try journalctl
+                        const journalResult = await executeCommand({
+                            command: "journalctl",
+                            args: ["-u", "falco", "--no-pager", "-n", String(lines), "-o", "json"],
+                            timeout: 10000,
+                        });
+                        if (journalResult.exitCode === 0) {
+                            const events = journalResult.stdout.trim().split("\n").filter(Boolean).map((l) => {
+                                try {
+                                    return JSON.parse(l);
+                                }
+                                catch {
+                                    return { raw: l };
+                                }
+                            });
+                            return { content: [formatToolOutput({ source: "journalctl", events: events.slice(-lines) })] };
+                        }
+                        return { content: [createErrorContent("No Falco log file found and journalctl query failed")], isError: true };
+                    }
+                    const result = await executeCommand({
+                        command: "tail",
+                        args: ["-n", String(lines), logPath],
+                        timeout: 10000,
+                    });
+                    const events = result.stdout.trim().split("\n").filter(Boolean).map((l) => {
+                        try {
+                            return JSON.parse(l);
+                        }
+                        catch {
+                            return { raw: l };
+                        }
+                    });
+                    let filtered = events;
+                    if (priority) {
+                        const priorities = ["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"];
+                        const minIdx = priorities.indexOf(priority);
+                        filtered = events.filter((e) => {
+                            const p = typeof e.priority === "string" ? e.priority.toLowerCase() : "";
+                            const idx = priorities.indexOf(p);
+                            return idx >= 0 && idx <= minIdx;
+                        });
+                    }
+                    return {
+                        content: [formatToolOutput({
+                                source: logPath,
+                                totalEvents: filtered.length,
+                                events: filtered,
+                            })],
+                    };
+                }
+                catch (err) {
+                    return { content: [createErrorContent(`eBPF events retrieval failed: ${err instanceof Error ? err.message : String(err)}`)], isError: true };
+                }
+            }
+            default:
+                return { content: [createErrorContent(`Unknown action: ${action}`)], isError: true };
+        }
+    });
+}

package/build/tools/encryption.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Encryption and cryptography tools for Kali Defense MCP Server.
+ *
+ * Registers 4 tools: crypto_tls (actions: remote_audit, cert_expiry, config_audit),
+ * crypto_gpg_keys, crypto_luks_manage, crypto_file_hash.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerEncryptionTools(server: McpServer): void;
+//# sourceMappingURL=encryption.d.ts.map