defense-mcp-server 0.6.0

package/build/tools/encryption.js

@@ -0,0 +1,1667 @@
+/**
+ * Encryption and cryptography tools for Kali Defense MCP Server.
+ *
+ * Registers 4 tools: crypto_tls (actions: remote_audit, cert_expiry, config_audit),
+ * crypto_gpg_keys, crypto_luks_manage, crypto_file_hash.
+ */
+import { z } from "zod";
+import { executeCommand } from "../core/executor.js";
+import { getConfig, getToolTimeout } from "../core/config.js";
+import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
+import { logChange, createChangeEntry } from "../core/changelog.js";
+import { validateTarget, sanitizeArgs, validateCertPath, } from "../core/sanitizer.js";
+import { validateToolPath } from "../core/sanitizer.js";
+import { spawnSafe } from "../core/spawn-safe.js";
+// ── Helpers ────────────────────────────────────────────────────────────────
+/** Reject paths containing `..` directory-traversal sequences. */
+const PATH_TRAVERSAL_RE = /(^|[\/\\])\.\.([\/\\]|$)/;
+function assertNoTraversal(p) {
+    if (PATH_TRAVERSAL_RE.test(p)) {
+        throw new Error("Path contains forbidden directory traversal (..)");
+    }
+}
+// ── TOOL-023 remediation: encryption parameter validation ──────────────────
+/** Allowed encryption algorithms (explicit allowlist) */
+const ALLOWED_ALGORITHMS = new Set([
+    "aes-256-gcm",
+    "aes-256-cbc",
+    "aes-128-gcm",
+    "aes-128-cbc",
+    "chacha20-poly1305",
+]);
+/** Allowed directories for key file paths */
+const ALLOWED_KEY_DIRS = ["/etc/ssl", "/etc/pki", "/home", "/root", "/tmp", "/var/lib", "/opt"];
+/**
+ * Validate an encryption algorithm against the explicit allowlist.
+ */
+function validateAlgorithm(algorithm) {
+    const lower = algorithm.trim().toLowerCase();
+    if (!ALLOWED_ALGORITHMS.has(lower)) {
+        throw new Error(`Algorithm '${algorithm}' is not allowed. Allowed algorithms: ${[...ALLOWED_ALGORITHMS].join(", ")}`);
+    }
+    return lower;
+}
+/**
+ * Validate a key file path for traversal and containment within allowed directories.
+ */
+function validateKeyPath(keyPath) {
+    return validateToolPath(keyPath, ALLOWED_KEY_DIRS, "Key file path");
+}
+const WEAK_CIPHERS = [
+    "RC4",
+    "DES",
+    "NULL",
+    "EXPORT",
+    "anon",
+    "MD5",
+    "RC2",
+    "SEED",
+    "IDEA",
+];
+const WEAK_PROTOCOLS = ["SSLv2", "SSLv3", "TLSv1.0", "TLSv1.1", "TLSv1 "];
+function checkWeakCiphers(output) {
+    const found = [];
+    for (const cipher of WEAK_CIPHERS) {
+        if (output.toUpperCase().includes(cipher.toUpperCase())) {
+            found.push(cipher);
+        }
+    }
+    return found;
+}
+function checkWeakProtocols(output) {
+    const found = [];
+    for (const proto of WEAK_PROTOCOLS) {
+        if (output.includes(proto)) {
+            found.push(proto.trim());
+        }
+    }
+    return found;
+}
+/**
+ * Run a command via spawnSafe and collect output as a promise.
+ * Handles errors gracefully — returns error info instead of throwing.
+ */
+async function runCertCommand(command, args, timeoutMs = 30_000, stdinData) {
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawnSafe(command, args);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            resolve({ stdout: "", stderr: msg, exitCode: -1 });
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let resolved = false;
+        const timer = setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                child.kill("SIGTERM");
+                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
+            }
+        }, timeoutMs);
+        child.stdout?.on("data", (data) => {
+            stdout += data.toString();
+        });
+        child.stderr?.on("data", (data) => {
+            stderr += data.toString();
+        });
+        child.on("close", (code) => {
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timer);
+                resolve({ stdout, stderr, exitCode: code ?? -1 });
+            }
+        });
+        child.on("error", (err) => {
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timer);
+                resolve({ stdout, stderr: err.message, exitCode: -1 });
+            }
+        });
+        // Write stdin data if provided, then close
+        if (stdinData !== undefined && child.stdin) {
+            child.stdin.write(stdinData);
+            child.stdin.end();
+        }
+    });
+}
+// ── Registration entry point ───────────────────────────────────────────────
+export function registerEncryptionTools(server) {
+    // ── 1. crypto_tls (merged: remote_audit, cert_expiry, config_audit) ───
+    server.tool("crypto_tls", "TLS/SSL security: audit remote host TLS config, check certificate expiry, or audit local web server TLS configuration.", {
+        action: z.enum(["remote_audit", "cert_expiry", "config_audit"]).describe("Action: remote_audit=audit remote TLS, cert_expiry=check cert expiry, config_audit=audit local TLS config"),
+        // remote_audit params
+        host: z.string().optional().describe("Target hostname or IP address (remote_audit/cert_expiry)"),
+        port: z.number().optional().default(443).describe("Target port (remote_audit/cert_expiry)"),
+        check_ciphers: z.boolean().optional().default(true).describe("Check for weak cipher suites (remote_audit)"),
+        check_protocols: z.boolean().optional().default(true).describe("Check for weak protocol versions (remote_audit)"),
+        check_certificate: z.boolean().optional().default(true).describe("Check certificate details (remote_audit)"),
+        // cert_expiry params
+        cert_path: z.string().optional().describe("Local certificate file path to check (cert_expiry)"),
+        warn_days: z.number().optional().default(30).describe("Days before expiry to issue a warning (cert_expiry)"),
+        // config_audit params
+        service: z.enum(["apache", "nginx", "system", "all"]).optional().default("all").describe("Service to audit TLS config for (config_audit)"),
+    }, async (params) => {
+        const { action } = params;
+        switch (action) {
+            // ── remote_audit ────────────────────────────────────────────
+            case "remote_audit": {
+                const { host, port, check_ciphers, check_protocols, check_certificate } = params;
+                if (!host) {
+                    return { content: [createErrorContent("host is required for remote_audit action")], isError: true };
+                }
+                try {
+                    const validHost = validateTarget(host);
+                    const sections = [];
+                    sections.push(`🔐 TLS/SSL Audit: ${validHost}:${port}`);
+                    sections.push("=".repeat(50));
+                    // Basic connection test
+                    const connResult = await executeCommand({
+                        command: "openssl",
+                        args: [
+                            "s_client",
+                            "-connect",
+                            `${validHost}:${port}`,
+                            "-servername",
+                            validHost,
+                            "-brief",
+                        ],
+                        stdin: "",
+                        toolName: "crypto_tls_audit",
+                        timeout: getToolTimeout("crypto_tls_audit"),
+                    });
+                    const fullOutput = connResult.stdout + "\n" + connResult.stderr;
+                    if (connResult.exitCode !== 0 && !fullOutput.includes("Protocol")) {
+                        return {
+                            content: [
+                                createErrorContent(`Failed to connect to ${validHost}:${port}: ${connResult.stderr}`),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sections.push("\n📡 Connection Info:");
+                    // Extract protocol and cipher from output
+                    const protocolMatch = fullOutput.match(/Protocol\s*:\s*(\S+)/);
+                    const cipherMatch = fullOutput.match(/Cipher\s*:\s*(\S+)/);
+                    if (protocolMatch)
+                        sections.push(`  Protocol: ${protocolMatch[1]}`);
+                    if (cipherMatch)
+                        sections.push(`  Cipher: ${cipherMatch[1]}`);
+                    // Detailed connection for more info
+                    const detailResult = await executeCommand({
+                        command: "openssl",
+                        args: [
+                            "s_client",
+                            "-connect",
+                            `${validHost}:${port}`,
+                            "-servername",
+                            validHost,
+                        ],
+                        stdin: "",
+                        toolName: "crypto_tls_audit",
+                        timeout: getToolTimeout("crypto_tls_audit"),
+                    });
+                    const detailOutput = detailResult.stdout + "\n" + detailResult.stderr;
+                    // Check certificate details
+                    if (check_certificate) {
+                        sections.push("\n📜 Certificate Details:");
+                        const subjectMatch = detailOutput.match(/subject=([^\n]+)/);
+                        const issuerMatch = detailOutput.match(/issuer=([^\n]+)/);
+                        const datesMatch = detailOutput.match(/Not Before:\s*([^\n]+)[\s\S]*?Not After\s*:\s*([^\n]+)/);
+                        const verifyMatch = detailOutput.match(/Verify return code:\s*(\d+)\s*\(([^)]+)\)/);
+                        if (subjectMatch)
+                            sections.push(`  Subject: ${subjectMatch[1].trim()}`);
+                        if (issuerMatch)
+                            sections.push(`  Issuer: ${issuerMatch[1].trim()}`);
+                        if (datesMatch) {
+                            sections.push(`  Not Before: ${datesMatch[1].trim()}`);
+                            sections.push(`  Not After: ${datesMatch[2].trim()}`);
+                            // Check expiry
+                            const expiryDate = new Date(datesMatch[2].trim());
+                            const now = new Date();
+                            const daysLeft = Math.floor((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+                            if (daysLeft < 0) {
+                                sections.push(`  ⛔ EXPIRED ${Math.abs(daysLeft)} days ago`);
+                            }
+                            else if (daysLeft < 30) {
+                                sections.push(`  ⚠️ WARNING: Expires in ${daysLeft} days`);
+                            }
+                            else {
+                                sections.push(`  ✅ Valid for ${daysLeft} more days`);
+                            }
+                        }
+                        if (verifyMatch) {
+                            const code = parseInt(verifyMatch[1], 10);
+                            const reason = verifyMatch[2];
+                            if (code === 0) {
+                                sections.push(`  ✅ Verification: OK`);
+                            }
+                            else {
+                                sections.push(`  ⛔ Verification FAILED: ${reason} (code ${code})`);
+                            }
+                        }
+                        // Check for self-signed
+                        if (detailOutput.includes("self signed certificate") ||
+                            detailOutput.includes("self-signed")) {
+                            sections.push(`  ⚠️ Self-signed certificate detected`);
+                        }
+                    }
+                    // Check for weak ciphers
+                    if (check_ciphers) {
+                        sections.push("\n🔑 Cipher Analysis:");
+                        const weakFound = checkWeakCiphers(detailOutput);
+                        if (weakFound.length > 0) {
+                            sections.push(`  ⛔ Weak ciphers detected: ${weakFound.join(", ")}`);
+                        }
+                        else {
+                            sections.push(`  ✅ No known weak ciphers detected in connection`);
+                        }
+                    }
+                    // Check for weak protocols
+                    if (check_protocols) {
+                        sections.push("\n🔒 Protocol Analysis:");
+                        const weakProtos = checkWeakProtocols(detailOutput);
+                        if (weakProtos.length > 0) {
+                            sections.push(`  ⛔ Weak protocols detected: ${weakProtos.join(", ")}`);
+                        }
+                        else {
+                            sections.push(`  ✅ No weak protocols detected in connection`);
+                        }
+                        // Test specific weak protocols
+                        const testProtocols = [
+                            { name: "TLSv1", arg: "-tls1" },
+                            { name: "TLSv1.1", arg: "-tls1_1" },
+                            { name: "TLSv1.2", arg: "-tls1_2" },
+                        ];
+                        for (const proto of testProtocols) {
+                            const protoResult = await executeCommand({
+                                command: "openssl",
+                                args: [
+                                    "s_client",
+                                    "-connect",
+                                    `${validHost}:${port}`,
+                                    "-servername",
+                                    validHost,
+                                    proto.arg,
+                                ],
+                                stdin: "",
+                                toolName: "crypto_tls_audit",
+                                timeout: 10000,
+                            });
+                            const protoOutput = protoResult.stdout + protoResult.stderr;
+                            const connected = protoOutput.includes("Protocol  :") ||
+                                protoOutput.includes("Cipher    :") ||
+                                (protoResult.exitCode === 0 &&
+                                    !protoOutput.includes("no protocols available"));
+                            if (proto.name === "TLSv1" ||
+                                proto.name === "TLSv1.1") {
+                                if (connected) {
+                                    sections.push(`  ⚠️ ${proto.name}: Supported (deprecated, should be disabled)`);
+                                }
+                                else {
+                                    sections.push(`  ✅ ${proto.name}: Not supported (good)`);
+                                }
+                            }
+                            else {
+                                if (connected) {
+                                    sections.push(`  ✅ ${proto.name}: Supported`);
+                                }
+                                else {
+                                    sections.push(`  ℹ️ ${proto.name}: Not supported`);
+                                }
+                            }
+                        }
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { content: [createErrorContent(msg)], isError: true };
+                }
+            }
+            // ── cert_expiry ─────────────────────────────────────────────
+            case "cert_expiry": {
+                const { cert_path, host, port, warn_days } = params;
+                try {
+                    if (!cert_path && !host) {
+                        return {
+                            content: [
+                                createErrorContent("Must specify either cert_path (local file) or host (remote check)"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    const sections = [];
+                    sections.push("📅 Certificate Expiry Check");
+                    sections.push("=".repeat(40));
+                    let endDate = "";
+                    let subject = "";
+                    let issuer = "";
+                    if (cert_path) {
+                        const validPath = validateCertPath(cert_path);
+                        sections.push(`\nLocal certificate: ${validPath}`);
+                        const result = await executeCommand({
+                            command: "openssl",
+                            args: [
+                                "x509",
+                                "-in",
+                                validPath,
+                                "-noout",
+                                "-enddate",
+                                "-subject",
+                                "-issuer",
+                            ],
+                            toolName: "crypto_cert_expiry",
+                            timeout: getToolTimeout("crypto_cert_expiry"),
+                        });
+                        if (result.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createErrorContent(`Failed to read certificate: ${result.stderr}`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                        const endMatch = result.stdout.match(/notAfter=(.+)/);
+                        const subjectMatch = result.stdout.match(/subject=(.+)/);
+                        const issuerMatch = result.stdout.match(/issuer=(.+)/);
+                        if (endMatch)
+                            endDate = endMatch[1].trim();
+                        if (subjectMatch)
+                            subject = subjectMatch[1].trim();
+                        if (issuerMatch)
+                            issuer = issuerMatch[1].trim();
+                    }
+                    else if (host) {
+                        const validHost = validateTarget(host);
+                        sections.push(`\nRemote host: ${validHost}:${port}`);
+                        const result = await executeCommand({
+                            command: "openssl",
+                            args: [
+                                "s_client",
+                                "-connect",
+                                `${validHost}:${port}`,
+                                "-servername",
+                                validHost,
+                            ],
+                            stdin: "",
+                            toolName: "crypto_cert_expiry",
+                            timeout: getToolTimeout("crypto_cert_expiry"),
+                        });
+                        const fullOutput = result.stdout + "\n" + result.stderr;
+                        // Extract dates from the connection output
+                        const notAfterMatch = fullOutput.match(/Not After\s*:\s*([^\n]+)/);
+                        const subjectMatch = fullOutput.match(/subject=([^\n]+)/);
+                        const issuerMatch = fullOutput.match(/issuer=([^\n]+)/);
+                        if (notAfterMatch)
+                            endDate = notAfterMatch[1].trim();
+                        if (subjectMatch)
+                            subject = subjectMatch[1].trim();
+                        if (issuerMatch)
+                            issuer = issuerMatch[1].trim();
+                        if (!endDate) {
+                            // Try parsing cert separately via pipe
+                            const certMatch = fullOutput.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/);
+                            if (certMatch) {
+                                const dateResult = await executeCommand({
+                                    command: "openssl",
+                                    args: ["x509", "-noout", "-enddate", "-subject", "-issuer"],
+                                    stdin: certMatch[0],
+                                    toolName: "crypto_cert_expiry",
+                                    timeout: 10000,
+                                });
+                                const endM = dateResult.stdout.match(/notAfter=(.+)/);
+                                const subM = dateResult.stdout.match(/subject=(.+)/);
+                                const issM = dateResult.stdout.match(/issuer=(.+)/);
+                                if (endM)
+                                    endDate = endM[1].trim();
+                                if (subM)
+                                    subject = subM[1].trim();
+                                if (issM)
+                                    issuer = issM[1].trim();
+                            }
+                        }
+                    }
+                    if (!endDate) {
+                        return {
+                            content: [
+                                createErrorContent("Could not determine certificate expiry date"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    if (subject)
+                        sections.push(`  Subject: ${subject}`);
+                    if (issuer)
+                        sections.push(`  Issuer: ${issuer}`);
+                    sections.push(`  Expiry: ${endDate}`);
+                    // Calculate days until expiry
+                    const expiryDate = new Date(endDate);
+                    const now = new Date();
+                    const daysLeft = Math.floor((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+                    let status;
+                    if (daysLeft < 0) {
+                        status = "CRITICAL";
+                        sections.push(`\n⛔ Status: ${status} - Certificate EXPIRED ${Math.abs(daysLeft)} days ago`);
+                    }
+                    else if (daysLeft <= warn_days) {
+                        status = "WARNING";
+                        sections.push(`\n⚠️ Status: ${status} - Certificate expires in ${daysLeft} days (threshold: ${warn_days})`);
+                    }
+                    else {
+                        status = "OK";
+                        sections.push(`\n✅ Status: ${status} - Certificate valid for ${daysLeft} more days`);
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { content: [createErrorContent(msg)], isError: true };
+                }
+            }
+            // ── config_audit ────────────────────────────────────────────
+            case "config_audit": {
+                const { service } = params;
+                try {
+                    const sections = [];
+                    sections.push("🔍 TLS Configuration Audit");
+                    sections.push("=".repeat(40));
+                    const findings = [];
+                    // Apache audit
+                    if (service === "apache" || service === "all") {
+                        sections.push("\n── Apache TLS Configuration ──");
+                        const apacheResult = await executeCommand({
+                            command: "find",
+                            args: ["/etc/apache2/sites-enabled/", "-type", "f", "-name", "*.conf"],
+                            toolName: "crypto_tls",
+                            timeout: 10000,
+                        });
+                        if (apacheResult.exitCode === 0 && apacheResult.stdout.trim()) {
+                            const confFiles = apacheResult.stdout.trim().split("\n").filter((f) => f.trim());
+                            for (const confFile of confFiles) {
+                                const catResult = await executeCommand({
+                                    command: "cat",
+                                    args: [confFile.trim()],
+                                    toolName: "crypto_tls",
+                                    timeout: 5000,
+                                });
+                                if (catResult.exitCode === 0) {
+                                    const content = catResult.stdout;
+                                    sections.push(`\n  File: ${confFile.trim()}`);
+                                    const protoMatch = content.match(/SSLProtocol\s+(.+)/);
+                                    if (protoMatch) {
+                                        sections.push(`  SSLProtocol: ${protoMatch[1].trim()}`);
+                                        const proto = protoMatch[1];
+                                        if (proto.includes("SSLv3") || proto.includes("TLSv1 ") || proto.includes("TLSv1.0") || proto.includes("TLSv1.1")) {
+                                            findings.push({ level: "CRITICAL", msg: `${confFile}: Weak protocol in SSLProtocol: ${protoMatch[1].trim()}` });
+                                        }
+                                    }
+                                    const cipherMatch = content.match(/SSLCipherSuite\s+(.+)/);
+                                    if (cipherMatch) {
+                                        sections.push(`  SSLCipherSuite: ${cipherMatch[1].trim().substring(0, 80)}...`);
+                                        const weakCiphers = checkWeakCiphers(cipherMatch[1]);
+                                        if (weakCiphers.length > 0) {
+                                            findings.push({ level: "WARNING", msg: `${confFile}: Weak ciphers found: ${weakCiphers.join(", ")}` });
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        else {
+                            sections.push("  Apache not installed or no sites-enabled configuration found.");
+                        }
+                    }
+                    // Nginx audit
+                    if (service === "nginx" || service === "all") {
+                        sections.push("\n── Nginx TLS Configuration ──");
+                        const nginxResult = await executeCommand({
+                            command: "find",
+                            args: ["/etc/nginx/", "-type", "f", "-name", "*.conf"],
+                            toolName: "crypto_tls",
+                            timeout: 10000,
+                        });
+                        if (nginxResult.exitCode === 0 && nginxResult.stdout.trim()) {
+                            const confFiles = nginxResult.stdout.trim().split("\n").filter((f) => f.trim());
+                            for (const confFile of confFiles) {
+                                const catResult = await executeCommand({
+                                    command: "cat",
+                                    args: [confFile.trim()],
+                                    toolName: "crypto_tls",
+                                    timeout: 5000,
+                                });
+                                if (catResult.exitCode === 0) {
+                                    const content = catResult.stdout;
+                                    if (content.includes("ssl_protocols") || content.includes("ssl_ciphers")) {
+                                        sections.push(`\n  File: ${confFile.trim()}`);
+                                        const protoMatch = content.match(/ssl_protocols\s+([^;]+)/);
+                                        if (protoMatch) {
+                                            sections.push(`  ssl_protocols: ${protoMatch[1].trim()}`);
+                                            const proto = protoMatch[1];
+                                            if (proto.includes("SSLv3") || proto.includes("TLSv1 ") || proto.includes("TLSv1.0") || proto.includes("TLSv1.1")) {
+                                                findings.push({ level: "CRITICAL", msg: `${confFile}: Weak protocol in ssl_protocols: ${protoMatch[1].trim()}` });
+                                            }
+                                        }
+                                        const cipherMatch = content.match(/ssl_ciphers\s+['"]?([^;'"]+)/);
+                                        if (cipherMatch) {
+                                            sections.push(`  ssl_ciphers: ${cipherMatch[1].trim().substring(0, 80)}...`);
+                                            const weakCiphers = checkWeakCiphers(cipherMatch[1]);
+                                            if (weakCiphers.length > 0) {
+                                                findings.push({ level: "WARNING", msg: `${confFile}: Weak ciphers: ${weakCiphers.join(", ")}` });
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        else {
+                            sections.push("  Nginx not installed or no configuration found.");
+                        }
+                    }
+                    // System-wide crypto audit
+                    if (service === "system" || service === "all") {
+                        sections.push("\n── System-Wide Crypto Configuration ──");
+                        const opensslResult = await executeCommand({
+                            command: "cat",
+                            args: ["/etc/ssl/openssl.cnf"],
+                            toolName: "crypto_tls",
+                            timeout: 5000,
+                        });
+                        if (opensslResult.exitCode === 0) {
+                            sections.push("\n  OpenSSL config (/etc/ssl/openssl.cnf): Found");
+                            const minProtoMatch = opensslResult.stdout.match(/MinProtocol\s*=\s*(\S+)/);
+                            if (minProtoMatch)
+                                sections.push(`  MinProtocol: ${minProtoMatch[1]}`);
+                            const cipherStringMatch = opensslResult.stdout.match(/CipherString\s*=\s*(\S+)/);
+                            if (cipherStringMatch)
+                                sections.push(`  CipherString: ${cipherStringMatch[1]}`);
+                        }
+                        else {
+                            sections.push("  OpenSSL config: Not found at /etc/ssl/openssl.cnf");
+                        }
+                        const policyResult = await executeCommand({
+                            command: "cat",
+                            args: ["/etc/crypto-policies/config"],
+                            toolName: "crypto_tls",
+                            timeout: 5000,
+                        });
+                        if (policyResult.exitCode === 0 && policyResult.stdout.trim()) {
+                            sections.push(`\n  System crypto policy: ${policyResult.stdout.trim()}`);
+                            const policy = policyResult.stdout.trim().toUpperCase();
+                            if (policy === "LEGACY" || policy === "DEFAULT") {
+                                findings.push({ level: "WARNING", msg: `System crypto policy is '${policyResult.stdout.trim()}' - consider using FUTURE or FIPS` });
+                            }
+                        }
+                        const versionResult = await executeCommand({
+                            command: "openssl",
+                            args: ["version"],
+                            toolName: "crypto_tls",
+                            timeout: 5000,
+                        });
+                        if (versionResult.exitCode === 0) {
+                            sections.push(`\n  OpenSSL version: ${versionResult.stdout.trim()}`);
+                        }
+                    }
+                    // Summary
+                    sections.push("\n── Findings Summary ──");
+                    if (findings.length === 0) {
+                        sections.push("  ✅ No critical TLS configuration issues found.");
+                    }
+                    else {
+                        const criticals = findings.filter((f) => f.level === "CRITICAL");
+                        const warnings = findings.filter((f) => f.level === "WARNING");
+                        if (criticals.length > 0) {
+                            sections.push(`\n  ⛔ Critical (${criticals.length}):`);
+                            for (const f of criticals)
+                                sections.push(`    - ${f.msg}`);
+                        }
+                        if (warnings.length > 0) {
+                            sections.push(`\n  ⚠️ Warnings (${warnings.length}):`);
+                            for (const f of warnings)
+                                sections.push(`    - ${f.msg}`);
+                        }
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { content: [createErrorContent(msg)], isError: true };
+                }
+            }
+            default:
+                return { content: [createErrorContent(`Unknown action: ${action}`)], isError: true };
+        }
+    });
+    // ── 2. crypto_gpg_keys (kept as-is) ──────────────────────────────────────
+    server.tool("crypto_gpg_keys", "Manage GPG keys: list, generate, export, import, or verify signatures", {
+        action: z
+            .enum(["list", "generate", "export", "import", "verify"])
+            .describe("GPG action to perform"),
+        key_id: z
+            .string()
+            .optional()
+            .describe("GPG key ID (for export/verify)"),
+        file_path: z
+            .string()
+            .optional()
+            .describe("File path (for import/verify)"),
+        dry_run: z
+            .boolean()
+            .optional()
+            .describe("Preview changes without executing (defaults to KALI_DEFENSE_DRY_RUN env var)"),
+    }, async ({ action, key_id, file_path, dry_run }) => {
+        try {
+            const sections = [];
+            sections.push(`🔑 GPG Key Management: ${action}`);
+            sections.push("=".repeat(40));
+            switch (action) {
+                case "list": {
+                    const result = await executeCommand({
+                        command: "gpg",
+                        args: ["--list-keys", "--keyid-format", "long"],
+                        toolName: "crypto_gpg_keys",
+                        timeout: getToolTimeout("crypto_gpg_keys"),
+                    });
+                    if (result.exitCode !== 0 && !result.stdout) {
+                        sections.push("\nNo GPG keys found or GPG not configured.");
+                        sections.push(`stderr: ${result.stderr}`);
+                    }
+                    else {
+                        sections.push("\nPublic Keys:");
+                        sections.push(result.stdout || "No keys found");
+                    }
+                    // Also list secret keys
+                    const secretResult = await executeCommand({
+                        command: "gpg",
+                        args: ["--list-secret-keys", "--keyid-format", "long"],
+                        toolName: "crypto_gpg_keys",
+                        timeout: getToolTimeout("crypto_gpg_keys"),
+                    });
+                    if (secretResult.stdout.trim()) {
+                        sections.push("\nSecret Keys:");
+                        sections.push(secretResult.stdout);
+                    }
+                    break;
+                }
+                case "generate": {
+                    if (dry_run ?? getConfig().dryRun) {
+                        sections.push("\n[DRY RUN] Would generate a new GPG key pair.");
+                        sections.push("Command: gpg --full-generate-key");
+                        sections.push("\nNote: Key generation is interactive and requires user input.");
+                        sections.push("To generate non-interactively, create a batch file with parameters.");
+                        sections.push("\nExample batch file content:");
+                        sections.push("  %no-protection");
+                        sections.push("  Key-Type: RSA");
+                        sections.push("  Key-Length: 4096");
+                        sections.push("  Subkey-Type: RSA");
+                        sections.push("  Subkey-Length: 4096");
+                        sections.push("  Name-Real: Your Name");
+                        sections.push("  Name-Email: your@email.com");
+                        sections.push("  Expire-Date: 1y");
+                        sections.push("  %commit");
+                    }
+                    else {
+                        sections.push("⚠️ Interactive GPG key generation cannot be run in non-interactive mode.");
+                        sections.push("Use 'gpg --batch --gen-key <batch_file>' for non-interactive generation.");
+                    }
+                    break;
+                }
+                case "export": {
+                    if (!key_id) {
+                        return {
+                            content: [
+                                createErrorContent("key_id is required for GPG key export"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([key_id]);
+                    const result = await executeCommand({
+                        command: "gpg",
+                        args: ["--export", "--armor", key_id],
+                        toolName: "crypto_gpg_keys",
+                        timeout: getToolTimeout("crypto_gpg_keys"),
+                    });
+                    if (result.exitCode !== 0 || !result.stdout.trim()) {
+                        return {
+                            content: [
+                                createErrorContent(`Failed to export key ${key_id}: ${result.stderr}`),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sections.push(`\nExported public key for: ${key_id}`);
+                    sections.push(result.stdout);
+                    break;
+                }
+                case "import": {
+                    if (!file_path) {
+                        return {
+                            content: [
+                                createErrorContent("file_path is required for GPG key import"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([file_path]);
+                    // TOOL-023: Validate key file path with containment check
+                    validateKeyPath(file_path);
+                    if (dry_run ?? getConfig().dryRun) {
+                        sections.push(`\n[DRY RUN] Would import GPG key from: ${file_path}`);
+                        sections.push(`Command: gpg --import ${file_path}`);
+                    }
+                    else {
+                        const result = await executeCommand({
+                            command: "gpg",
+                            args: ["--import", file_path],
+                            toolName: "crypto_gpg_keys",
+                            timeout: getToolTimeout("crypto_gpg_keys"),
+                        });
+                        if (result.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createErrorContent(`Failed to import key: ${result.stderr}`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                        sections.push(`\n✅ Key imported from: ${file_path}`);
+                        sections.push(result.stderr || result.stdout);
+                        logChange(createChangeEntry({
+                            tool: "crypto_gpg_keys",
+                            action: "import",
+                            target: file_path,
+                            after: result.stderr || result.stdout,
+                            dryRun: false,
+                            success: true,
+                        }));
+                    }
+                    break;
+                }
+                case "verify": {
+                    if (!file_path) {
+                        return {
+                            content: [
+                                createErrorContent("file_path is required for GPG signature verification"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([file_path]);
+                    // TOOL-023: Validate key file path with containment check
+                    validateKeyPath(file_path);
+                    const result = await executeCommand({
+                        command: "gpg",
+                        args: ["--verify", file_path],
+                        toolName: "crypto_gpg_keys",
+                        timeout: getToolTimeout("crypto_gpg_keys"),
+                    });
+                    const output = result.stderr || result.stdout;
+                    if (result.exitCode !== 0) {
+                        sections.push(`\n⛔ Signature verification FAILED for: ${file_path}`);
+                    }
+                    else {
+                        sections.push(`\n✅ Signature verification PASSED for: ${file_path}`);
+                    }
+                    sections.push(output);
+                    break;
+                }
+            }
+            return { content: [createTextContent(sections.join("\n"))] };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { content: [createErrorContent(msg)], isError: true };
+        }
+    });
+    // ── 3. crypto_luks_manage (kept as-is) ───────────────────────────────────
+    server.tool("crypto_luks_manage", "Manage LUKS encrypted volumes: check status, dump headers, open/close, or list encrypted devices", {
+        action: z
+            .enum(["status", "dump", "open", "close", "list"])
+            .describe("LUKS management action"),
+        device: z
+            .string()
+            .optional()
+            .describe("Block device path (e.g., /dev/sda2) for status/dump/open"),
+        name: z
+            .string()
+            .optional()
+            .describe("Mapper name for open/close operations"),
+        dry_run: z
+            .boolean()
+            .optional()
+            .describe("Preview changes without executing (defaults to KALI_DEFENSE_DRY_RUN env var)"),
+    }, async ({ action, device, name, dry_run }) => {
+        try {
+            const sections = [];
+            sections.push(`🔐 LUKS Volume Management: ${action}`);
+            sections.push("=".repeat(40));
+            switch (action) {
+                case "status": {
+                    if (!name) {
+                        return {
+                            content: [
+                                createErrorContent("name (mapper name) is required for status check"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([name]);
+                    const result = await executeCommand({
+                        command: "sudo",
+                        args: ["cryptsetup", "status", name],
+                        toolName: "crypto_luks_manage",
+                        timeout: getToolTimeout("crypto_luks_manage"),
+                    });
+                    if (result.exitCode !== 0) {
+                        sections.push(`\n⚠️ Device mapper '${name}' not found or not active.`);
+                        sections.push(result.stderr || result.stdout);
+                    }
+                    else {
+                        sections.push(`\nStatus for /dev/mapper/${name}:`);
+                        sections.push(result.stdout);
+                    }
+                    break;
+                }
+                case "dump": {
+                    if (!device) {
+                        return {
+                            content: [
+                                createErrorContent("device path is required for LUKS header dump"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([device]);
+                    assertNoTraversal(device);
+                    const result = await executeCommand({
+                        command: "sudo",
+                        args: ["cryptsetup", "luksDump", device],
+                        toolName: "crypto_luks_manage",
+                        timeout: getToolTimeout("crypto_luks_manage"),
+                    });
+                    if (result.exitCode !== 0) {
+                        return {
+                            content: [
+                                createErrorContent(`Failed to dump LUKS header for ${device}: ${result.stderr}`),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sections.push(`\nLUKS Header Dump for ${device}:`);
+                    sections.push(result.stdout);
+                    break;
+                }
+                case "open": {
+                    if (!device || !name) {
+                        return {
+                            content: [
+                                createErrorContent("Both device and name are required for LUKS open"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([device, name]);
+                    assertNoTraversal(device);
+                    if (dry_run ?? getConfig().dryRun) {
+                        sections.push(`\n[DRY RUN] Would open LUKS volume:`);
+                        sections.push(`  Device: ${device}`);
+                        sections.push(`  Mapper name: ${name}`);
+                        sections.push(`  Command: sudo cryptsetup luksOpen ${device} ${name}`);
+                        sections.push("\nNote: This operation requires a passphrase and cannot be run non-interactively without a key file.");
+                    }
+                    else {
+                        sections.push("⚠️ Interactive LUKS open requires a passphrase.");
+                        sections.push("Use a key file with: sudo cryptsetup luksOpen --key-file <keyfile> <device> <name>");
+                        logChange(createChangeEntry({
+                            tool: "crypto_luks_manage",
+                            action: "open_attempted",
+                            target: device,
+                            dryRun: false,
+                            success: false,
+                            error: "Interactive passphrase required, cannot run non-interactively",
+                        }));
+                    }
+                    break;
+                }
+                case "close": {
+                    if (!name) {
+                        return {
+                            content: [
+                                createErrorContent("name (mapper name) is required for LUKS close"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    sanitizeArgs([name]);
+                    if (dry_run ?? getConfig().dryRun) {
+                        sections.push(`\n[DRY RUN] Would close LUKS volume: /dev/mapper/${name}`);
+                        sections.push(`  Command: sudo cryptsetup luksClose ${name}`);
+                    }
+                    else {
+                        const result = await executeCommand({
+                            command: "sudo",
+                            args: ["cryptsetup", "luksClose", name],
+                            toolName: "crypto_luks_manage",
+                            timeout: getToolTimeout("crypto_luks_manage"),
+                        });
+                        if (result.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createErrorContent(`Failed to close LUKS volume ${name}: ${result.stderr}`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                        sections.push(`\n✅ LUKS volume '${name}' closed successfully.`);
+                        logChange(createChangeEntry({
+                            tool: "crypto_luks_manage",
+                            action: "close",
+                            target: name,
+                            dryRun: false,
+                            success: true,
+                            rollbackCommand: `sudo cryptsetup luksOpen <device> ${name}`,
+                        }));
+                    }
+                    break;
+                }
+                case "list": {
+                    // List device mapper entries
+                    const mapperResult = await executeCommand({
+                        command: "ls",
+                        args: ["-la", "/dev/mapper/"],
+                        toolName: "crypto_luks_manage",
+                        timeout: getToolTimeout("crypto_luks_manage"),
+                    });
+                    sections.push("\n📁 Device Mapper Entries:");
+                    sections.push(mapperResult.stdout || "No entries found");
+                    // List block devices with filesystem info
+                    const lsblkResult = await executeCommand({
+                        command: "lsblk",
+                        args: ["--fs", "-o", "NAME,FSTYPE,SIZE,MOUNTPOINT,UUID"],
+                        toolName: "crypto_luks_manage",
+                        timeout: getToolTimeout("crypto_luks_manage"),
+                    });
+                    sections.push("\n💾 Block Devices (with filesystem info):");
+                    sections.push(lsblkResult.stdout || "No block devices found");
+                    // Filter for crypto entries
+                    const cryptoLines = (lsblkResult.stdout || "")
+                        .split("\n")
+                        .filter((l) => l.includes("crypto_LUKS") || l.includes("crypt"));
+                    if (cryptoLines.length > 0) {
+                        sections.push("\n🔐 LUKS Encrypted Devices:");
+                        for (const line of cryptoLines) {
+                            sections.push(`  ${line.trim()}`);
+                        }
+                    }
+                    else {
+                        sections.push("\nNo LUKS encrypted devices detected.");
+                    }
+                    break;
+                }
+            }
+            return { content: [createTextContent(sections.join("\n"))] };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { content: [createErrorContent(msg)], isError: true };
+        }
+    });
+    // ── 4. crypto_file_hash (kept as-is) ─────────────────────────────────────
+    server.tool("crypto_file_hash", "Calculate cryptographic hashes of files for integrity verification", {
+        path: z.string().describe("File or directory path to hash"),
+        algorithm: z
+            .enum(["sha256", "sha512", "sha1", "md5"])
+            .optional()
+            .default("sha256")
+            .describe("Hash algorithm to use (default: sha256)"),
+        recursive: z
+            .boolean()
+            .optional()
+            .default(false)
+            .describe("Recursively hash all files in a directory"),
+    }, async ({ path, algorithm, recursive }) => {
+        try {
+            sanitizeArgs([path]);
+            assertNoTraversal(path);
+            const sections = [];
+            const hashCmd = `${algorithm}sum`;
+            sections.push(`#️⃣ File Integrity Hash (${algorithm.toUpperCase()})`);
+            sections.push("=".repeat(40));
+            if (recursive) {
+                // Hash all files in directory recursively
+                const result = await executeCommand({
+                    command: "find",
+                    args: [
+                        path,
+                        "-type",
+                        "f",
+                        "-exec",
+                        hashCmd,
+                        "{}",
+                        "+",
+                    ],
+                    toolName: "crypto_file_hash",
+                    timeout: getToolTimeout("crypto_file_hash"),
+                });
+                if (result.exitCode !== 0 && !result.stdout) {
+                    return {
+                        content: [
+                            createErrorContent(`Failed to hash files in ${path}: ${result.stderr}`),
+                        ],
+                        isError: true,
+                    };
+                }
+                const lines = result.stdout
+                    .trim()
+                    .split("\n")
+                    .filter((l) => l.trim());
+                sections.push(`\nDirectory: ${path}`);
+                sections.push(`Files hashed: ${lines.length}`);
+                sections.push(`\nResults:`);
+                sections.push(result.stdout);
+            }
+            else {
+                // Hash a single file
+                const result = await executeCommand({
+                    command: hashCmd,
+                    args: [path],
+                    toolName: "crypto_file_hash",
+                    timeout: getToolTimeout("crypto_file_hash"),
+                });
+                if (result.exitCode !== 0) {
+                    return {
+                        content: [
+                            createErrorContent(`Failed to hash ${path}: ${result.stderr}`),
+                        ],
+                        isError: true,
+                    };
+                }
+                sections.push(`\nFile: ${path}`);
+                sections.push(`Algorithm: ${algorithm.toUpperCase()}`);
+                const hashValue = result.stdout.trim().split(/\s+/)[0];
+                sections.push(`Hash: ${hashValue}`);
+                sections.push(`\nFull output: ${result.stdout.trim()}`);
+            }
+            return { content: [createTextContent(sections.join("\n"))] };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { content: [createErrorContent(msg)], isError: true };
+        }
+    });
+    // ── 5. certificate_lifecycle ──────────────────────────────────────────────
+    server.tool("certificate_lifecycle", "Certificate lifecycle management: inventory system certificates, check auto-renewal, audit CA trust store, verify OCSP revocation status, and monitor Certificate Transparency logs.", {
+        action: z
+            .enum(["inventory", "auto_renew_check", "ca_audit", "ocsp_check", "ct_log_monitor"])
+            .describe("Action: inventory=scan system certs, auto_renew_check=check certbot/ACME renewal, ca_audit=audit CA trust store, ocsp_check=check OCSP revocation, ct_log_monitor=check CT logs"),
+        domain: z
+            .string()
+            .optional()
+            .describe("Domain for OCSP/CT checks"),
+        cert_path: z
+            .string()
+            .optional()
+            .describe("Path to specific certificate file"),
+        search_paths: z
+            .array(z.string())
+            .optional()
+            .describe("Additional paths to search for certificates"),
+        output_format: z
+            .enum(["text", "json"])
+            .optional()
+            .default("text")
+            .describe("Output format (default text)"),
+    }, async (params) => {
+        const { action } = params;
+        switch (action) {
+            // ── inventory ──────────────────────────────────────────────────
+            case "inventory": {
+                try {
+                    const defaultPaths = [
+                        "/etc/ssl/certs/",
+                        "/etc/pki/tls/certs/",
+                        "/etc/letsencrypt/live/",
+                        "/usr/local/share/ca-certificates/",
+                    ];
+                    const searchPaths = [...defaultPaths, ...(params.search_paths ?? [])];
+                    for (const p of searchPaths) {
+                        assertNoTraversal(p);
+                    }
+                    const allCerts = [];
+                    for (const searchPath of searchPaths) {
+                        const findResult = await runCertCommand("find", [
+                            searchPath, "-name", "*.pem", "-o", "-name", "*.crt", "-o", "-name", "*.cer",
+                        ], 15_000);
+                        if (findResult.exitCode === 0 && findResult.stdout.trim()) {
+                            const certs = findResult.stdout.trim().split("\n").filter((c) => c.trim());
+                            allCerts.push(...certs);
+                        }
+                    }
+                    const certDetails = [];
+                    let expiredCount = 0;
+                    let expiringSoonCount = 0;
+                    let validCount = 0;
+                    const certsToCheck = allCerts.slice(0, 100);
+                    for (const certFile of certsToCheck) {
+                        const certResult = await runCertCommand("openssl", [
+                            "x509", "-in", certFile.trim(), "-noout",
+                            "-subject", "-issuer", "-dates", "-serial",
+                        ], 5_000);
+                        if (certResult.exitCode === 0) {
+                            const out = certResult.stdout;
+                            const subjectMatch = out.match(/subject=(.+)/);
+                            const issuerMatch = out.match(/issuer=(.+)/);
+                            const notBeforeMatch = out.match(/notBefore=(.+)/);
+                            const notAfterMatch = out.match(/notAfter=(.+)/);
+                            const serialMatch = out.match(/serial=(.+)/);
+                            const notAfter = notAfterMatch ? notAfterMatch[1].trim() : "";
+                            let daysLeft = 0;
+                            let status = "valid";
+                            if (notAfter) {
+                                const expiryDate = new Date(notAfter);
+                                const now = new Date();
+                                daysLeft = Math.floor((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+                                if (daysLeft < 0) {
+                                    status = "expired";
+                                    expiredCount++;
+                                }
+                                else if (daysLeft < 30) {
+                                    status = "expiring_soon";
+                                    expiringSoonCount++;
+                                }
+                                else {
+                                    validCount++;
+                                }
+                            }
+                            certDetails.push({
+                                path: certFile.trim(),
+                                subject: subjectMatch ? subjectMatch[1].trim() : "unknown",
+                                issuer: issuerMatch ? issuerMatch[1].trim() : "unknown",
+                                notBefore: notBeforeMatch ? notBeforeMatch[1].trim() : "unknown",
+                                notAfter: notAfter || "unknown",
+                                serial: serialMatch ? serialMatch[1].trim() : "unknown",
+                                status,
+                                daysLeft,
+                            });
+                        }
+                    }
+                    const output = {
+                        action: "inventory",
+                        totalCerts: certDetails.length,
+                        expired: expiredCount,
+                        expiringSoon: expiringSoonCount,
+                        valid: validCount,
+                        certificates: certDetails,
+                        searchPaths,
+                    };
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(output)] };
+                    }
+                    const sections = [];
+                    sections.push("📜 Certificate Inventory");
+                    sections.push("=".repeat(50));
+                    sections.push(`\nTotal certificates found: ${certDetails.length}`);
+                    sections.push(`  ✅ Valid: ${validCount}`);
+                    sections.push(`  ⚠️ Expiring soon (< 30 days): ${expiringSoonCount}`);
+                    sections.push(`  ⛔ Expired: ${expiredCount}`);
+                    if (expiredCount > 0) {
+                        sections.push("\n── Expired Certificates ──");
+                        for (const cert of certDetails.filter((c) => c.status === "expired")) {
+                            sections.push(`  ${cert.path}`);
+                            sections.push(`    Subject: ${cert.subject}`);
+                            sections.push(`    Expired: ${Math.abs(cert.daysLeft)} days ago`);
+                        }
+                    }
+                    if (expiringSoonCount > 0) {
+                        sections.push("\n── Expiring Soon ──");
+                        for (const cert of certDetails.filter((c) => c.status === "expiring_soon")) {
+                            sections.push(`  ${cert.path}`);
+                            sections.push(`    Subject: ${cert.subject}`);
+                            sections.push(`    Expires in: ${cert.daysLeft} days`);
+                        }
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { content: [createErrorContent(`inventory failed: ${msg}`)], isError: true };
+                }
+            }
+            // ── auto_renew_check ───────────────────────────────────────────
+            case "auto_renew_check": {
+                try {
+                    const findings = { action: "auto_renew_check" };
+                    const certbotCheck = await runCertCommand("which", ["certbot"], 5_000);
+                    const certbotInstalled = certbotCheck.exitCode === 0;
+                    findings.certbotInstalled = certbotInstalled;
+                    if (!certbotInstalled) {
+                        findings.status = "certbot_not_found";
+                        findings.recommendations = [
+                            "Certbot is not installed. Install with: apt install certbot",
+                        ];
+                        if (params.output_format === "json") {
+                            return { content: [formatToolOutput(findings)] };
+                        }
+                        const sections = [];
+                        sections.push("🔄 Auto-Renewal Check");
+                        sections.push("=".repeat(50));
+                        sections.push("\n⚠️ Certbot is not installed.");
+                        sections.push("  Install with: apt install certbot");
+                        return { content: [createTextContent(sections.join("\n"))] };
+                    }
+                    // Check certbot timer
+                    const timerResult = await runCertCommand("systemctl", ["status", "certbot.timer"], 10_000);
+                    const timerActive = timerResult.exitCode === 0 &&
+                        timerResult.stdout.includes("active");
+                    findings.timerActive = timerActive;
+                    findings.timerOutput = timerResult.stdout.trim();
+                    // List certbot certificates
+                    const certsResult = await runCertCommand("certbot", ["certificates"], 15_000);
+                    findings.certificates = certsResult.stdout.trim();
+                    findings.certbotExitCode = certsResult.exitCode;
+                    // Check renewal configs
+                    const renewalResult = await runCertCommand("find", [
+                        "/etc/letsencrypt/renewal/", "-name", "*.conf",
+                    ], 5_000);
+                    const renewalConfigs = renewalResult.exitCode === 0 && renewalResult.stdout.trim()
+                        ? renewalResult.stdout.trim().split("\n").filter((l) => l.trim())
+                        : [];
+                    findings.renewalConfigs = renewalConfigs;
+                    // Check cron for renewal jobs
+                    const cronResult = await runCertCommand("grep", [
+                        "-r", "certbot", "/etc/cron.d/", "/etc/cron.daily/", "/etc/crontab",
+                    ], 5_000);
+                    const cronJobs = cronResult.exitCode === 0 && cronResult.stdout.trim()
+                        ? cronResult.stdout.trim().split("\n").filter((l) => l.trim())
+                        : [];
+                    findings.cronJobs = cronJobs;
+                    findings.status = "checked";
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(findings)] };
+                    }
+                    const sections = [];
+                    sections.push("🔄 Auto-Renewal Check");
+                    sections.push("=".repeat(50));
+                    sections.push(`\nCertbot: installed at ${certbotCheck.stdout.trim()}`);
+                    sections.push(`Timer: ${timerActive ? "✅ Active" : "⚠️ Not active"}`);
+                    sections.push("\nManaged Certificates:");
+                    sections.push(certsResult.stdout.trim() || "  No certificates found");
+                    sections.push(`\nRenewal Configs (${renewalConfigs.length}):`);
+                    for (const conf of renewalConfigs) {
+                        sections.push(`  ${conf}`);
+                    }
+                    if (cronJobs.length > 0) {
+                        sections.push("\nCron Jobs:");
+                        for (const job of cronJobs) {
+                            sections.push(`  ${job}`);
+                        }
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`auto_renew_check failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            // ── ca_audit ───────────────────────────────────────────────────
+            case "ca_audit": {
+                try {
+                    const findings = { action: "ca_audit" };
+                    let trustStorePath = "/etc/ssl/certs/";
+                    const sslCheck = await runCertCommand("ls", ["/etc/ssl/certs/"], 5_000);
+                    if (sslCheck.exitCode !== 0) {
+                        const pkiCheck = await runCertCommand("ls", ["/etc/pki/tls/certs/"], 5_000);
+                        if (pkiCheck.exitCode === 0) {
+                            trustStorePath = "/etc/pki/tls/certs/";
+                        }
+                    }
+                    findings.trustStorePath = trustStorePath;
+                    const caListResult = await runCertCommand("find", [
+                        trustStorePath,
+                        "-name", "*.pem", "-o", "-name", "*.crt",
+                    ], 10_000);
+                    const caFiles = caListResult.exitCode === 0 && caListResult.stdout.trim()
+                        ? caListResult.stdout.trim().split("\n").filter((l) => l.trim())
+                        : [];
+                    findings.totalCAs = caFiles.length;
+                    const recentResult = await runCertCommand("find", [
+                        trustStorePath,
+                        "-mtime", "-30",
+                        "-name", "*.pem",
+                        "-o",
+                        "-mtime", "-30",
+                        "-name", "*.crt",
+                    ], 10_000);
+                    const recentlyAdded = recentResult.exitCode === 0 && recentResult.stdout.trim()
+                        ? recentResult.stdout.trim().split("\n").filter((l) => l.trim())
+                        : [];
+                    findings.recentlyAdded = recentlyAdded;
+                    findings.recentlyAddedCount = recentlyAdded.length;
+                    const suspiciousPatterns = [
+                        "test", "debug", "fake", "temporary", "tmp",
+                        "self-signed", "localhost", "example",
+                    ];
+                    const suspiciousFindings = [];
+                    for (const caFile of caFiles.slice(0, 200)) {
+                        const lower = caFile.toLowerCase();
+                        for (const pattern of suspiciousPatterns) {
+                            if (lower.includes(pattern)) {
+                                suspiciousFindings.push(caFile);
+                                break;
+                            }
+                        }
+                    }
+                    findings.suspiciousFindings = suspiciousFindings;
+                    findings.suspiciousCount = suspiciousFindings.length;
+                    const updateCheck = await runCertCommand("which", ["update-ca-certificates"], 5_000);
+                    findings.updateCaCertificatesAvailable =
+                        updateCheck.exitCode === 0;
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(findings)] };
+                    }
+                    const sections = [];
+                    sections.push("🏛️ CA Trust Store Audit");
+                    sections.push("=".repeat(50));
+                    sections.push(`\nTrust store path: ${trustStorePath}`);
+                    sections.push(`Total trusted CAs: ${caFiles.length}`);
+                    sections.push(`Recently added (last 30 days): ${recentlyAdded.length}`);
+                    if (recentlyAdded.length > 0) {
+                        sections.push("\n── Recently Added CAs ──");
+                        for (const ca of recentlyAdded.slice(0, 20)) {
+                            sections.push(`  ${ca}`);
+                        }
+                    }
+                    if (suspiciousFindings.length > 0) {
+                        sections.push(`\n⚠️ Suspicious CAs Found (${suspiciousFindings.length}):`);
+                        for (const ca of suspiciousFindings.slice(0, 20)) {
+                            sections.push(`  ${ca}`);
+                        }
+                    }
+                    else {
+                        sections.push("\n✅ No suspicious CA names detected.");
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`ca_audit failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            // ── ocsp_check ─────────────────────────────────────────────────
+            case "ocsp_check": {
+                try {
+                    if (!params.domain && !params.cert_path) {
+                        return {
+                            content: [
+                                createErrorContent("domain or cert_path is required for ocsp_check"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    const findings = {
+                        action: "ocsp_check",
+                    };
+                    let certPem = "";
+                    if (params.domain) {
+                        const validDomain = validateTarget(params.domain);
+                        findings.domain = validDomain;
+                        // Get certificate chain from domain
+                        const sClientResult = await runCertCommand("openssl", [
+                            "s_client", "-connect", `${validDomain}:443`,
+                            "-servername", validDomain, "-showcerts",
+                        ], 10_000, "");
+                        const fullOutput = sClientResult.stdout + "\n" + sClientResult.stderr;
+                        const certMatches = fullOutput.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g);
+                        if (!certMatches || certMatches.length === 0) {
+                            findings.error =
+                                "Could not retrieve certificate from domain";
+                            if (params.output_format === "json") {
+                                return { content: [formatToolOutput(findings)] };
+                            }
+                            return {
+                                content: [
+                                    createErrorContent(`Could not retrieve certificate from ${validDomain}`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                        certPem = certMatches[0];
+                    }
+                    else if (params.cert_path) {
+                        assertNoTraversal(params.cert_path);
+                        const validPath = validateCertPath(params.cert_path);
+                        findings.certPath = validPath;
+                        const readResult = await runCertCommand("openssl", ["x509", "-in", validPath], 5_000);
+                        if (readResult.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createErrorContent(`Failed to read certificate: ${readResult.stderr}`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                        certPem = readResult.stdout;
+                    }
+                    // Extract OCSP URI from certificate via stdin
+                    const ocspUriResult = await runCertCommand("openssl", ["x509", "-noout", "-ocsp_uri"], 5_000, certPem);
+                    const ocspUri = ocspUriResult.stdout.trim();
+                    findings.ocspUri = ocspUri || "not found";
+                    if (!ocspUri) {
+                        findings.status = "no_ocsp_uri";
+                        findings.message =
+                            "Certificate does not contain an OCSP responder URI";
+                        if (params.output_format === "json") {
+                            return { content: [formatToolOutput(findings)] };
+                        }
+                        return {
+                            content: [
+                                createTextContent("🔍 OCSP Check\n" +
+                                    "=".repeat(50) +
+                                    "\n\n⚠️ Certificate does not contain an OCSP responder URI."),
+                            ],
+                        };
+                    }
+                    // Check OCSP stapling via s_client -status
+                    if (params.domain) {
+                        const validDomain = validateTarget(params.domain);
+                        const staplingResult = await runCertCommand("openssl", [
+                            "s_client", "-connect", `${validDomain}:443`,
+                            "-servername", validDomain, "-status",
+                        ], 10_000, "");
+                        const staplingOutput = staplingResult.stdout + staplingResult.stderr;
+                        const hasStapling = staplingOutput.includes("OCSP Response Status: successful");
+                        findings.ocspStapling = hasStapling;
+                        if (hasStapling) {
+                            if (staplingOutput.includes("Cert Status: good")) {
+                                findings.revocationStatus = "good";
+                            }
+                            else if (staplingOutput.includes("Cert Status: revoked")) {
+                                findings.revocationStatus = "revoked";
+                            }
+                            else {
+                                findings.revocationStatus = "unknown";
+                            }
+                        }
+                        else {
+                            findings.revocationStatus = "unknown";
+                            findings.message =
+                                "OCSP stapling not available; direct OCSP query may be needed";
+                        }
+                    }
+                    else {
+                        findings.revocationStatus = "unknown";
+                        findings.message =
+                            "Direct OCSP query requires domain; use domain parameter for full check";
+                    }
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(findings)] };
+                    }
+                    const sections = [];
+                    sections.push("🔍 OCSP Check");
+                    sections.push("=".repeat(50));
+                    sections.push(`\nOCSP Responder: ${ocspUri}`);
+                    sections.push(`Revocation Status: ${String(findings.revocationStatus)}`);
+                    if (findings.ocspStapling !== undefined) {
+                        sections.push(`OCSP Stapling: ${findings.ocspStapling ? "✅ Supported" : "⚠️ Not supported"}`);
+                    }
+                    if (findings.message) {
+                        sections.push(`\nNote: ${String(findings.message)}`);
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`ocsp_check failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            // ── ct_log_monitor ─────────────────────────────────────────────
+            case "ct_log_monitor": {
+                try {
+                    if (!params.domain) {
+                        return {
+                            content: [
+                                createErrorContent("domain is required for ct_log_monitor"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    const validDomain = validateTarget(params.domain);
+                    const findings = {
+                        action: "ct_log_monitor",
+                        domain: validDomain,
+                    };
+                    // Query crt.sh for certificates
+                    const crtshResult = await runCertCommand("curl", [
+                        "-s", "-m", "15",
+                        `https://crt.sh/?q=${encodeURIComponent(validDomain)}&output=json`,
+                    ], 20_000);
+                    if (crtshResult.exitCode !== 0 || !crtshResult.stdout.trim()) {
+                        findings.error = "Failed to query crt.sh";
+                        findings.stderr = crtshResult.stderr;
+                        if (params.output_format === "json") {
+                            return { content: [formatToolOutput(findings)] };
+                        }
+                        return {
+                            content: [
+                                createTextContent("🔍 CT Log Monitor\n" +
+                                    "=".repeat(50) +
+                                    `\n\n⚠️ Failed to query crt.sh for ${validDomain}.\n` +
+                                    `Error: ${crtshResult.stderr}`),
+                            ],
+                        };
+                    }
+                    let ctEntries = [];
+                    try {
+                        ctEntries = JSON.parse(crtshResult.stdout);
+                    }
+                    catch {
+                        findings.error = "Failed to parse crt.sh response";
+                        if (params.output_format === "json") {
+                            return { content: [formatToolOutput(findings)] };
+                        }
+                        return {
+                            content: [
+                                createErrorContent("Failed to parse crt.sh JSON response"),
+                            ],
+                            isError: true,
+                        };
+                    }
+                    findings.totalCerts = ctEntries.length;
+                    // Analyze certificates
+                    const issuers = new Set();
+                    const wildcardCerts = [];
+                    const recentCerts = [];
+                    const thirtyDaysAgo = new Date();
+                    thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
+                    for (const entry of ctEntries.slice(0, 200)) {
+                        const issuerName = String(entry.issuer_name ?? "unknown");
+                        issuers.add(issuerName);
+                        const commonName = String(entry.common_name ?? "");
+                        if (commonName.startsWith("*.")) {
+                            wildcardCerts.push(entry);
+                        }
+                        const notBefore = entry.not_before
+                            ? new Date(String(entry.not_before))
+                            : null;
+                        if (notBefore && notBefore > thirtyDaysAgo) {
+                            recentCerts.push(entry);
+                        }
+                    }
+                    findings.issuers = [...issuers];
+                    findings.wildcardCount = wildcardCerts.length;
+                    findings.recentCount = recentCerts.length;
+                    findings.recentCerts = recentCerts.slice(0, 20).map((e) => ({
+                        commonName: e.common_name,
+                        issuer: e.issuer_name,
+                        notBefore: e.not_before,
+                        notAfter: e.not_after,
+                    }));
+                    // Flag unexpected issuers
+                    const unexpectedFindings = [];
+                    if (issuers.size > 3) {
+                        unexpectedFindings.push(`Multiple issuers detected (${issuers.size}) — review for unauthorized certificate issuance`);
+                    }
+                    if (wildcardCerts.length > 0) {
+                        unexpectedFindings.push(`${wildcardCerts.length} wildcard certificate(s) found`);
+                    }
+                    findings.unexpectedFindings = unexpectedFindings;
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(findings)] };
+                    }
+                    const sections = [];
+                    sections.push("🔍 CT Log Monitor");
+                    sections.push("=".repeat(50));
+                    sections.push(`\nDomain: ${validDomain}`);
+                    sections.push(`Total certificates in CT logs: ${ctEntries.length}`);
+                    sections.push(`Unique issuers: ${issuers.size}`);
+                    sections.push(`Wildcard certificates: ${wildcardCerts.length}`);
+                    sections.push(`Recently issued (last 30 days): ${recentCerts.length}`);
+                    if (issuers.size > 0) {
+                        sections.push("\n── Issuers ──");
+                        for (const issuer of issuers) {
+                            sections.push(`  ${issuer}`);
+                        }
+                    }
+                    if (recentCerts.length > 0) {
+                        sections.push("\n── Recently Issued ──");
+                        for (const cert of recentCerts.slice(0, 10)) {
+                            sections.push(`  ${cert.common_name} (issued: ${cert.not_before}, by: ${cert.issuer_name})`);
+                        }
+                    }
+                    if (unexpectedFindings.length > 0) {
+                        sections.push("\n⚠️ Findings:");
+                        for (const finding of unexpectedFindings) {
+                            sections.push(`  ${finding}`);
+                        }
+                    }
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`ct_log_monitor failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            default:
+                return {
+                    content: [createErrorContent(`Unknown action: ${action}`)],
+                    isError: true,
+                };
+        }
+    });
+}