defense-mcp-server 0.6.0

package/build/tools/vulnerability-management.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Vulnerability management tools for Kali Defense MCP Server.
+ *
+ * Registers 1 tool: vuln_manage (actions: scan_system, scan_web, track, prioritize, remediation_plan)
+ *
+ * Provides vulnerability scanning, tracking, prioritization, and remediation planning
+ * using nmap, nikto, and searchsploit.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerVulnerabilityManagementTools(server: McpServer): void;
+//# sourceMappingURL=vulnerability-management.d.ts.map

package/build/tools/vulnerability-management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulnerability-management.d.ts","sourceRoot":"","sources":["../../src/tools/vulnerability-management.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4UpE,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAuf5E"}

package/build/tools/vulnerability-management.js

@@ -0,0 +1,667 @@
+/**
+ * Vulnerability management tools for Kali Defense MCP Server.
+ *
+ * Registers 1 tool: vuln_manage (actions: scan_system, scan_web, track, prioritize, remediation_plan)
+ *
+ * Provides vulnerability scanning, tracking, prioritization, and remediation planning
+ * using nmap, nikto, and searchsploit.
+ */
+import { z } from "zod";
+import { spawnSafe } from "../core/spawn-safe.js";
+import { secureWriteFileSync } from "../core/secure-fs.js";
+import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
+import { existsSync, readFileSync } from "node:fs";
+// ── Constants ──────────────────────────────────────────────────────────────────
+const VULN_TRACKER_PATH = "/var/lib/kali-defense/vuln-tracker.json";
+/**
+ * Run a command via spawnSafe and collect output as a promise.
+ * Handles errors gracefully — returns error info instead of throwing.
+ */
+async function runCommand(command, args, timeoutMs = 60_000) {
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawnSafe(command, args);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            resolve({ stdout: "", stderr: msg, exitCode: -1 });
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let resolved = false;
+        const timer = setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                child.kill("SIGTERM");
+                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
+            }
+        }, timeoutMs);
+        child.stdout?.on("data", (data) => {
+            stdout += data.toString();
+        });
+        child.stderr?.on("data", (data) => {
+            stderr += data.toString();
+        });
+        child.on("close", (code) => {
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timer);
+                resolve({ stdout, stderr, exitCode: code ?? -1 });
+            }
+        });
+        child.on("error", (err) => {
+            if (!resolved) {
+                resolved = true;
+                clearTimeout(timer);
+                resolve({ stdout, stderr: err.message, exitCode: -1 });
+            }
+        });
+    });
+}
+/**
+ * Load the vulnerability tracker database from disk.
+ */
+function loadTracker() {
+    if (!existsSync(VULN_TRACKER_PATH)) {
+        return { vulnerabilities: [], last_updated: new Date().toISOString() };
+    }
+    try {
+        const content = readFileSync(VULN_TRACKER_PATH, "utf-8");
+        return JSON.parse(content);
+    }
+    catch {
+        return { vulnerabilities: [], last_updated: new Date().toISOString() };
+    }
+}
+/**
+ * Save the vulnerability tracker database to disk using secure file ops.
+ */
+function saveTracker(data) {
+    data.last_updated = new Date().toISOString();
+    secureWriteFileSync(VULN_TRACKER_PATH, JSON.stringify(data, null, 2), "utf-8");
+}
+/**
+ * Parse nmap text output to extract vulnerability findings.
+ */
+function parseNmapOutput(output) {
+    const results = [];
+    const lines = output.split("\n");
+    let currentPort = "";
+    let currentService = "";
+    let currentVersion = "";
+    let currentVulns = [];
+    for (const line of lines) {
+        // Match port lines like "22/tcp open ssh OpenSSH 8.9p1"
+        const portMatch = line.match(/^(\d+\/\w+)\s+open\s+(\S+)\s*(.*)/);
+        if (portMatch) {
+            if (currentPort) {
+                results.push({
+                    port: currentPort,
+                    service: currentService,
+                    version: currentVersion,
+                    vulnerabilities: currentVulns,
+                });
+            }
+            currentPort = portMatch[1];
+            currentService = portMatch[2];
+            currentVersion = portMatch[3]?.trim() || "";
+            currentVulns = [];
+            continue;
+        }
+        // Match CVE references
+        const cveMatch = line.match(/(CVE-\d{4}-\d{4,})/);
+        if (cveMatch && currentPort) {
+            const severity = line.toLowerCase().includes("critical")
+                ? "critical"
+                : line.toLowerCase().includes("high")
+                    ? "high"
+                    : line.toLowerCase().includes("medium")
+                        ? "medium"
+                        : "unknown";
+            currentVulns.push({
+                id: cveMatch[1],
+                title: line.trim(),
+                severity,
+            });
+        }
+        // Match VULNERABLE state from NSE scripts
+        const vulnMatch = line.match(/^\|\s+State:\s+VULNERABLE/i);
+        if (vulnMatch && currentPort) {
+            if (currentVulns.length === 0) {
+                currentVulns.push({
+                    id: "NMAP-VULN",
+                    title: "Vulnerability detected by NSE script",
+                    severity: "medium",
+                });
+            }
+        }
+    }
+    // Push last port entry
+    if (currentPort) {
+        results.push({
+            port: currentPort,
+            service: currentService,
+            version: currentVersion,
+            vulnerabilities: currentVulns,
+        });
+    }
+    return results;
+}
+/**
+ * Parse nikto text output to extract findings.
+ */
+function parseNiktoOutput(output) {
+    const findings = [];
+    const lines = output.split("\n");
+    for (const line of lines) {
+        // Match OSVDB entries like "+ OSVDB-1234: /path: description"
+        const osvdbMatch = line.match(/\+\s+(OSVDB-\d+):\s+(\S+):\s+(.*)/);
+        if (osvdbMatch) {
+            findings.push({
+                id: osvdbMatch[1],
+                description: osvdbMatch[3].trim(),
+                path: osvdbMatch[2],
+            });
+            continue;
+        }
+        // Match general findings like "+ /path: description"
+        const generalMatch = line.match(/\+\s+(\/\S*):\s+(.*)/);
+        if (generalMatch) {
+            findings.push({
+                id: "NIKTO",
+                description: generalMatch[2].trim(),
+                path: generalMatch[1],
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Calculate priority score for a vulnerability.
+ * Higher score = higher priority.
+ */
+function calculatePriorityScore(vuln) {
+    let score = 0;
+    // CVSS score contributes most (0-10 range, multiply by 10)
+    if (vuln.cvss_score != null) {
+        score += vuln.cvss_score * 10;
+    }
+    // Severity score
+    switch (vuln.severity) {
+        case "critical":
+            score += 40;
+            break;
+        case "high":
+            score += 30;
+            break;
+        case "medium":
+            score += 20;
+            break;
+        case "low":
+            score += 10;
+            break;
+    }
+    // Age factor — older vulns get higher priority
+    const ageMs = Date.now() - new Date(vuln.discovered_at).getTime();
+    const ageDays = ageMs / (1000 * 60 * 60 * 24);
+    score += Math.min(ageDays, 30); // Cap at 30 days of bonus
+    // Exploit available elevates priority
+    if (vuln.exploit_available) {
+        score += 25;
+    }
+    return Math.round(score * 100) / 100;
+}
+/**
+ * Get recommended action for a vulnerability.
+ */
+function getRecommendedAction(vuln) {
+    if (vuln.exploit_available) {
+        return "URGENT: Exploit exists — apply patch immediately or implement workaround";
+    }
+    switch (vuln.severity) {
+        case "critical":
+            return "Apply vendor patch or upgrade immediately";
+        case "high":
+            return "Schedule patch within 7 days";
+        case "medium":
+            return "Schedule patch within 30 days";
+        case "low":
+            return "Address during next maintenance window";
+        default:
+            return "Investigate and assess impact";
+    }
+}
+/**
+ * Get specific remediation steps based on vulnerability data.
+ */
+function getRemediationSteps(vuln) {
+    const steps = [];
+    // CVE-based remediation
+    if (vuln.vuln_id.startsWith("CVE-")) {
+        steps.push(`Check vendor advisory for ${vuln.vuln_id}`);
+        steps.push("Apply the latest security patch from your package manager");
+    }
+    // Service-based remediation
+    if (vuln.affected_service) {
+        steps.push(`Update ${vuln.affected_service} to the latest version`);
+        steps.push(`Review ${vuln.affected_service} configuration for security hardening`);
+    }
+    // General steps
+    if (steps.length === 0) {
+        steps.push("Review vulnerability details and vendor advisories");
+        steps.push("Apply available patches: sudo apt update && sudo apt upgrade");
+        steps.push("Verify fix with a follow-up scan");
+    }
+    return steps.join("; ");
+}
+// ── Registration entry point ───────────────────────────────────────────────
+export function registerVulnerabilityManagementTools(server) {
+    server.tool("vuln_manage", "Vulnerability management: scan systems/web apps, track vulnerabilities, prioritize remediation, and generate remediation plans.", {
+        action: z
+            .enum(["scan_system", "scan_web", "track", "prioritize", "remediation_plan"])
+            .describe("Action: scan_system=nmap vuln scan, scan_web=nikto web scan, track=manage vuln tracker, prioritize=risk-based prioritization, remediation_plan=generate remediation plan"),
+        target: z
+            .string()
+            .optional()
+            .describe("IP/hostname/URL to scan (used with scan_system, scan_web)"),
+        port_range: z
+            .string()
+            .optional()
+            .default("1-1024")
+            .describe("Port range for scanning (used with scan_system, default 1-1024)"),
+        scan_type: z
+            .enum(["quick", "full", "stealth"])
+            .optional()
+            .default("quick")
+            .describe("Scan type (used with scan_system, default quick)"),
+        vuln_id: z
+            .string()
+            .optional()
+            .describe("Vulnerability ID for tracking (used with track)"),
+        severity: z
+            .string()
+            .optional()
+            .describe("Severity level for new vulnerability (used with track)"),
+        description: z
+            .string()
+            .optional()
+            .describe("Vulnerability description (used with track)"),
+        status: z
+            .enum(["open", "mitigated", "accepted", "false_positive"])
+            .optional()
+            .describe("Vulnerability status (used with track)"),
+        severity_filter: z
+            .enum(["critical", "high", "medium", "low", "all"])
+            .optional()
+            .default("all")
+            .describe("Severity filter for prioritization (used with prioritize, default all)"),
+        output_format: z
+            .enum(["text", "json"])
+            .optional()
+            .default("text")
+            .describe("Output format (default text)"),
+    }, async (params) => {
+        const { action } = params;
+        switch (action) {
+            case "scan_system": {
+                try {
+                    const target = params.target || "127.0.0.1";
+                    const scanType = params.scan_type || "quick";
+                    const portRange = params.port_range || "1-1024";
+                    // Build nmap arguments based on scan type
+                    let nmapArgs;
+                    switch (scanType) {
+                        case "quick":
+                            nmapArgs = ["-sV", "--script=vuln", "--top-ports", "100", target];
+                            break;
+                        case "full":
+                            nmapArgs = ["-sV", "--script=vuln", "-p", portRange, target];
+                            break;
+                        case "stealth":
+                            nmapArgs = ["-sS", "-sV", "--script=vuln", target];
+                            break;
+                        default:
+                            nmapArgs = ["-sV", "--script=vuln", "--top-ports", "100", target];
+                    }
+                    const nmapResult = await runCommand("nmap", nmapArgs, 120_000);
+                    if (nmapResult.exitCode === -1 && nmapResult.stderr.includes("not in allowlist")) {
+                        return {
+                            content: [createErrorContent("nmap is not installed or not in the command allowlist. Install with: sudo apt install nmap")],
+                            isError: true,
+                        };
+                    }
+                    // Parse nmap output
+                    const parsedResults = parseNmapOutput(nmapResult.stdout);
+                    // Run searchsploit against discovered service versions
+                    const exploitResults = [];
+                    for (const svcResult of parsedResults) {
+                        if (svcResult.version) {
+                            const searchsploitResult = await runCommand("searchsploit", ["--json", `${svcResult.service} ${svcResult.version}`], 30_000);
+                            if (searchsploitResult.exitCode === 0 && searchsploitResult.stdout.trim()) {
+                                try {
+                                    const exploitData = JSON.parse(searchsploitResult.stdout);
+                                    const exploits = (exploitData.RESULTS_EXPLOIT || [])
+                                        .slice(0, 5)
+                                        .map((e) => e.Title || e.Path);
+                                    if (exploits.length > 0) {
+                                        exploitResults.push({
+                                            service: `${svcResult.service} ${svcResult.version}`,
+                                            exploits,
+                                        });
+                                    }
+                                }
+                                catch {
+                                    // JSON parse failed — searchsploit may have returned non-JSON
+                                }
+                            }
+                        }
+                    }
+                    const output = {
+                        target,
+                        scanType,
+                        portRange: scanType === "full" ? portRange : undefined,
+                        nmapExitCode: nmapResult.exitCode,
+                        services: parsedResults,
+                        totalVulnerabilities: parsedResults.reduce((acc, r) => acc + r.vulnerabilities.length, 0),
+                        exploitSearch: exploitResults,
+                        raw: nmapResult.stdout.slice(0, 5000),
+                    };
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(output)] };
+                    }
+                    return {
+                        content: [createTextContent(`Vulnerability Scan Results (${scanType}) — Target: ${target}\n\n` +
+                                `Services Found: ${parsedResults.length}\n` +
+                                `Vulnerabilities: ${output.totalVulnerabilities}\n` +
+                                `Exploits Found: ${exploitResults.length}\n\n` +
+                                nmapResult.stdout.slice(0, 5000) +
+                                (exploitResults.length > 0
+                                    ? `\n\nKnown Exploits:\n${exploitResults.map((e) => `  ${e.service}: ${e.exploits.join(", ")}`).join("\n")}`
+                                    : ""))],
+                    };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`System scan failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            case "scan_web": {
+                try {
+                    const target = params.target || "http://localhost";
+                    const niktoResult = await runCommand("nikto", ["-h", target, "-Format", "txt"], 120_000);
+                    if (niktoResult.exitCode === -1 && niktoResult.stderr.includes("not in allowlist")) {
+                        return {
+                            content: [createErrorContent("nikto is not installed or not in the command allowlist. Install with: sudo apt install nikto")],
+                            isError: true,
+                        };
+                    }
+                    const findings = parseNiktoOutput(niktoResult.stdout);
+                    const output = {
+                        target,
+                        niktoExitCode: niktoResult.exitCode,
+                        totalFindings: findings.length,
+                        findings,
+                        raw: niktoResult.stdout.slice(0, 5000),
+                    };
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(output)] };
+                    }
+                    return {
+                        content: [createTextContent(`Web Vulnerability Scan — Target: ${target}\n\n` +
+                                `Findings: ${findings.length}\n\n` +
+                                findings
+                                    .map((f) => `  [${f.id}] ${f.path}: ${f.description}`)
+                                    .join("\n") +
+                                (niktoResult.stdout
+                                    ? `\n\nRaw Output:\n${niktoResult.stdout.slice(0, 5000)}`
+                                    : ""))],
+                    };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`Web scan failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            case "track": {
+                try {
+                    const tracker = loadTracker();
+                    // If vuln_id provided with status, update existing
+                    if (params.vuln_id && params.status) {
+                        const existing = tracker.vulnerabilities.find((v) => v.vuln_id === params.vuln_id);
+                        if (existing) {
+                            existing.status = params.status;
+                            existing.updated_at = new Date().toISOString();
+                            saveTracker(tracker);
+                            return {
+                                content: [formatToolOutput({
+                                        action: "updated",
+                                        vuln_id: params.vuln_id,
+                                        new_status: params.status,
+                                        vulnerability: existing,
+                                    })],
+                            };
+                        }
+                    }
+                    // If vuln_id provided with severity and description, add new
+                    if (params.vuln_id && params.severity && params.description) {
+                        const existingIdx = tracker.vulnerabilities.findIndex((v) => v.vuln_id === params.vuln_id);
+                        if (existingIdx >= 0) {
+                            return {
+                                content: [createErrorContent(`Vulnerability ${params.vuln_id} already exists. Use status parameter to update.`)],
+                                isError: true,
+                            };
+                        }
+                        const newVuln = {
+                            vuln_id: params.vuln_id,
+                            severity: params.severity,
+                            description: params.description,
+                            status: params.status || "open",
+                            discovered_at: new Date().toISOString(),
+                            updated_at: new Date().toISOString(),
+                        };
+                        tracker.vulnerabilities.push(newVuln);
+                        saveTracker(tracker);
+                        return {
+                            content: [formatToolOutput({
+                                    action: "added",
+                                    vulnerability: newVuln,
+                                    totalTracked: tracker.vulnerabilities.length,
+                                })],
+                        };
+                    }
+                    // If vuln_id provided alone, get details
+                    if (params.vuln_id) {
+                        const vuln = tracker.vulnerabilities.find((v) => v.vuln_id === params.vuln_id);
+                        if (!vuln) {
+                            return {
+                                content: [createErrorContent(`Vulnerability ${params.vuln_id} not found in tracker.`)],
+                                isError: true,
+                            };
+                        }
+                        return { content: [formatToolOutput({ vulnerability: vuln })] };
+                    }
+                    // No vuln_id — list all tracked vulnerabilities
+                    return {
+                        content: [formatToolOutput({
+                                totalTracked: tracker.vulnerabilities.length,
+                                byStatus: {
+                                    open: tracker.vulnerabilities.filter((v) => v.status === "open").length,
+                                    mitigated: tracker.vulnerabilities.filter((v) => v.status === "mitigated").length,
+                                    accepted: tracker.vulnerabilities.filter((v) => v.status === "accepted").length,
+                                    false_positive: tracker.vulnerabilities.filter((v) => v.status === "false_positive").length,
+                                },
+                                vulnerabilities: tracker.vulnerabilities,
+                                last_updated: tracker.last_updated,
+                            })],
+                    };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`Vulnerability tracking failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            case "prioritize": {
+                try {
+                    const tracker = loadTracker();
+                    const severityFilter = params.severity_filter || "all";
+                    // Filter by status (only open vulnerabilities)
+                    let vulns = tracker.vulnerabilities.filter((v) => v.status === "open");
+                    // Filter by severity
+                    if (severityFilter !== "all") {
+                        vulns = vulns.filter((v) => v.severity === severityFilter);
+                    }
+                    // Calculate priority scores and sort
+                    const prioritized = vulns
+                        .map((v) => ({
+                        ...v,
+                        priority_score: calculatePriorityScore(v),
+                        recommended_action: getRecommendedAction(v),
+                    }))
+                        .sort((a, b) => b.priority_score - a.priority_score);
+                    const output = {
+                        filter: severityFilter,
+                        totalOpen: vulns.length,
+                        prioritized,
+                        summary: {
+                            critical: prioritized.filter((v) => v.severity === "critical").length,
+                            high: prioritized.filter((v) => v.severity === "high").length,
+                            medium: prioritized.filter((v) => v.severity === "medium").length,
+                            low: prioritized.filter((v) => v.severity === "low").length,
+                            withExploits: prioritized.filter((v) => v.exploit_available).length,
+                        },
+                    };
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(output)] };
+                    }
+                    return {
+                        content: [createTextContent(`Vulnerability Prioritization (filter: ${severityFilter})\n\n` +
+                                `Total Open: ${vulns.length}\n\n` +
+                                prioritized
+                                    .map((v, i) => `${i + 1}. [${v.severity.toUpperCase()}] ${v.vuln_id} (score: ${v.priority_score})\n` +
+                                    `   ${v.description}\n` +
+                                    `   Action: ${v.recommended_action}` +
+                                    (v.exploit_available ? "\n   ⚠ EXPLOIT AVAILABLE" : ""))
+                                    .join("\n\n"))],
+                    };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`Prioritization failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            case "remediation_plan": {
+                try {
+                    const tracker = loadTracker();
+                    const openVulns = tracker.vulnerabilities.filter((v) => v.status === "open");
+                    // Group by urgency
+                    const immediate = openVulns.filter((v) => (v.severity === "critical" || v.severity === "high") &&
+                        v.exploit_available);
+                    const shortTerm = openVulns.filter((v) => (v.severity === "high" && !v.exploit_available) ||
+                        (v.severity === "medium" && v.exploit_available === true));
+                    const mediumTerm = openVulns.filter((v) => v.severity === "medium" && !v.exploit_available);
+                    const longTerm = openVulns.filter((v) => v.severity === "low");
+                    const plan = {
+                        generated_at: new Date().toISOString(),
+                        total_open: openVulns.length,
+                        immediate_action: {
+                            description: "Critical/high severity with known exploits — patch immediately",
+                            count: immediate.length,
+                            vulnerabilities: immediate.map((v) => ({
+                                vuln_id: v.vuln_id,
+                                severity: v.severity,
+                                description: v.description,
+                                remediation: getRemediationSteps(v),
+                            })),
+                        },
+                        short_term: {
+                            description: "High severity without exploits, medium with exploits — patch within 7 days",
+                            count: shortTerm.length,
+                            vulnerabilities: shortTerm.map((v) => ({
+                                vuln_id: v.vuln_id,
+                                severity: v.severity,
+                                description: v.description,
+                                remediation: getRemediationSteps(v),
+                            })),
+                        },
+                        medium_term: {
+                            description: "Medium severity without exploits — patch within 30 days",
+                            count: mediumTerm.length,
+                            vulnerabilities: mediumTerm.map((v) => ({
+                                vuln_id: v.vuln_id,
+                                severity: v.severity,
+                                description: v.description,
+                                remediation: getRemediationSteps(v),
+                            })),
+                        },
+                        long_term: {
+                            description: "Low severity — patch during next maintenance window",
+                            count: longTerm.length,
+                            vulnerabilities: longTerm.map((v) => ({
+                                vuln_id: v.vuln_id,
+                                severity: v.severity,
+                                description: v.description,
+                                remediation: getRemediationSteps(v),
+                            })),
+                        },
+                    };
+                    if (params.output_format === "json") {
+                        return { content: [formatToolOutput(plan)] };
+                    }
+                    let text = `Remediation Plan — Generated: ${plan.generated_at}\n`;
+                    text += `Total Open Vulnerabilities: ${openVulns.length}\n\n`;
+                    text += `═══ IMMEDIATE ACTION (${immediate.length}) ═══\n`;
+                    text += `${plan.immediate_action.description}\n`;
+                    for (const v of plan.immediate_action.vulnerabilities) {
+                        text += `  • [${v.severity.toUpperCase()}] ${v.vuln_id}: ${v.description}\n`;
+                        text += `    Remediation: ${v.remediation}\n`;
+                    }
+                    text += `\n═══ SHORT-TERM (${shortTerm.length}) ═══\n`;
+                    text += `${plan.short_term.description}\n`;
+                    for (const v of plan.short_term.vulnerabilities) {
+                        text += `  • [${v.severity.toUpperCase()}] ${v.vuln_id}: ${v.description}\n`;
+                        text += `    Remediation: ${v.remediation}\n`;
+                    }
+                    text += `\n═══ MEDIUM-TERM (${mediumTerm.length}) ═══\n`;
+                    text += `${plan.medium_term.description}\n`;
+                    for (const v of plan.medium_term.vulnerabilities) {
+                        text += `  • [${v.severity.toUpperCase()}] ${v.vuln_id}: ${v.description}\n`;
+                        text += `    Remediation: ${v.remediation}\n`;
+                    }
+                    text += `\n═══ LONG-TERM (${longTerm.length}) ═══\n`;
+                    text += `${plan.long_term.description}\n`;
+                    for (const v of plan.long_term.vulnerabilities) {
+                        text += `  • [${v.severity.toUpperCase()}] ${v.vuln_id}: ${v.description}\n`;
+                        text += `    Remediation: ${v.remediation}\n`;
+                    }
+                    return { content: [createTextContent(text)] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return {
+                        content: [createErrorContent(`Remediation plan generation failed: ${msg}`)],
+                        isError: true,
+                    };
+                }
+            }
+            default:
+                return {
+                    content: [createErrorContent(`Unknown action: ${action}`)],
+                    isError: true,
+                };
+        }
+    });
+}