defense-mcp-server 0.9.1 → 0.9.2

package/build/core/config.d.ts

@@ -59,6 +59,22 @@ export interface DefenseConfig {
     commandTimeout: number;
     /** Network operation timeout in ms (default: 30s; env: DEFENSE_MCP_NETWORK_TIMEOUT) */
     networkTimeout: number;
+    /**
+     * SECURITY: Redact sensitive data (passwords, tokens, keys) from command
+     * output before returning to the LLM. Defaults to `true`.
+     * Env: DEFENSE_MCP_REDACT_OUTPUT (set to "false" to disable)
+     */
+    redactOutput: boolean;
+    /**
+     * When true, only register tools with readOnlyHint: true annotations.
+     * Env: DEFENSE_MCP_READ_ONLY (default: false)
+     */
+    readOnly: boolean;
+    /**
+     * Comma-separated list of tool names to register. Empty means all tools.
+     * Env: DEFENSE_MCP_ALLOWED_TOOLS (default: "")
+     */
+    allowedTools: string[];
 }
 /**
  * Returns the current configuration by reading environment variables.

package/build/core/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,WAAW,iKAed,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;CACxB;AAmGD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAQzC;AAwFD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAIR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAkBR"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,WAAW,iKAed,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C;;;;;OAKG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,WAAW,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAmGD;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,aAAa,CAQzC;AA8FD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAIR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,MAAM,CAkBR"}

package/build/core/config.js

@@ -168,6 +168,12 @@ function buildConfigFromEnv() {
             const sec = parseInt(process.env.DEFENSE_MCP_NETWORK_TIMEOUT ?? "30", 10);
             return isNaN(sec) || sec <= 0 ? 30_000 : sec * 1000;
         })(),
+        redactOutput: process.env.DEFENSE_MCP_REDACT_OUTPUT !== "false",
+        readOnly: process.env.DEFENSE_MCP_READ_ONLY === "true",
+        allowedTools: (() => {
+            const raw = process.env.DEFENSE_MCP_ALLOWED_TOOLS ?? "";
+            return raw.split(",").map(s => s.trim()).filter(s => s.length > 0);
+        })(),
     };
     // Warn when dry-run is active so operators know no changes will be applied
     if (config.dryRun) {

package/build/core/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/core/executor.ts"],"names":[],"mappings":"AAkFA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA0FD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqOxB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/core/executor.ts"],"names":[],"mappings":"AAmFA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA0FD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAoPxB"}

package/build/core/executor.js

@@ -6,6 +6,7 @@ import { getConfig, getToolTimeout } from "./config.js";
 import { SudoSession } from "./sudo-session.js";
 import { SudoGuard } from "./sudo-guard.js";
 import { resolveCommand, resolveSudoCommand } from "./command-allowlist.js";
+import { redactOutput } from "./output-redactor.js";
 // ── Askpass helper detection ─────────────────────────────────────────────────
 /**
  * Ordered list of known graphical sudo/SSH askpass helpers.
@@ -328,6 +329,18 @@ export async function executeCommand(options) {
             const exitCode = timedOut ? 124 : (code ?? 1);
             let stdout = Buffer.concat(stdoutChunks).toString("utf-8");
             let stderr = Buffer.concat(stderrChunks).toString("utf-8");
+            // ── Output sanitization: redact credentials before returning to LLM ──
+            if (getConfig().redactOutput) {
+                const stdoutR = redactOutput(stdout);
+                const stderrR = redactOutput(stderr);
+                stdout = stdoutR.text;
+                stderr = stderrR.text;
+                const total = stdoutR.redactionCount + stderrR.redactionCount;
+                if (total > 0) {
+                    const patterns = [...new Set([...stdoutR.matchedPatterns, ...stderrR.matchedPatterns])];
+                    console.error(`[output-redactor] Redacted ${total} sensitive pattern(s) from '${options.toolName}': ${patterns.join(", ")}`);
+                }
+            }
             if (stdoutCapped) {
                 stdout += "\n[OUTPUT TRUNCATED - exceeded max buffer]";
             }

package/build/core/output-redactor.d.ts

@@ -0,0 +1,26 @@
+/**
+ * output-redactor.ts — Post-execution output sanitization.
+ *
+ * Scans command stdout/stderr for sensitive data patterns and replaces
+ * them with [REDACTED] before returning results to the LLM.
+ *
+ * SECURITY: Over-redacting is preferred to under-redacting.
+ *
+ * @module output-redactor
+ */
+export interface RedactionResult {
+    /** The sanitized text */
+    text: string;
+    /** Number of redactions applied */
+    redactionCount: number;
+    /** Labels of patterns that matched */
+    matchedPatterns: string[];
+}
+/**
+ * Redact sensitive data from command output.
+ *
+ * @param text - Raw stdout or stderr text
+ * @returns Sanitized text with redaction metadata
+ */
+export declare function redactOutput(text: string): RedactionResult;
+//# sourceMappingURL=output-redactor.d.ts.map

package/build/core/output-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-redactor.d.ts","sourceRoot":"","sources":["../../src/core/output-redactor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmFH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAmB1D"}

package/build/core/output-redactor.js

@@ -0,0 +1,96 @@
+/**
+ * output-redactor.ts — Post-execution output sanitization.
+ *
+ * Scans command stdout/stderr for sensitive data patterns and replaces
+ * them with [REDACTED] before returning results to the LLM.
+ *
+ * SECURITY: Over-redacting is preferred to under-redacting.
+ *
+ * @module output-redactor
+ */
+const REDACTION_PATTERNS = [
+    // Private key blocks (PEM format)
+    {
+        pattern: /-----BEGIN\s[\w\s]*PRIVATE KEY-----[\s\S]*?-----END\s[\w\s]*PRIVATE KEY-----/g,
+        replacement: "[REDACTED: private key block]",
+        label: "private-key",
+    },
+    // AWS access key IDs (AKIA...)
+    {
+        pattern: /\bAKIA[0-9A-Z]{16}\b/g,
+        replacement: "[REDACTED: AWS access key]",
+        label: "aws-key",
+    },
+    // AWS secret access key after known labels
+    {
+        pattern: /(?:aws_secret_access_key|secret[_-]?access[_-]?key)\s*[=:]\s*[A-Za-z0-9/+=]{40}/gi,
+        replacement: "[REDACTED: AWS secret key]",
+        label: "aws-secret",
+    },
+    // Generic password patterns
+    {
+        pattern: /(?:password|passwd|pass|pwd)\s*[=:]\s*\S+/gi,
+        replacement: "[REDACTED: password]",
+        label: "password",
+    },
+    // Authorization / Bearer / Basic auth headers
+    {
+        pattern: /(?:Authorization|Bearer|Basic)\s*[:=]\s*\S+/gi,
+        replacement: "[REDACTED: auth token]",
+        label: "auth-header",
+    },
+    // API keys and tokens
+    {
+        pattern: /(?:api[_-]?key|api[_-]?token|access[_-]?token|auth[_-]?token|secret[_-]?key)\s*[=:]\s*\S+/gi,
+        replacement: "[REDACTED: api key/token]",
+        label: "api-key",
+    },
+    // Connection strings with embedded credentials
+    {
+        pattern: /(?:mysql|postgres(?:ql)?|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^:]+:[^@]+@/gi,
+        replacement: "[REDACTED: connection string]://",
+        label: "connection-string",
+    },
+    // /etc/shadow password hashes (user:$hash:...)
+    {
+        pattern: /^([^:]+):\$[0-9a-z]+\$[^:]+:/gm,
+        replacement: "$1:[REDACTED: password hash]:",
+        label: "shadow-hash",
+    },
+    // GitHub / GitLab personal access tokens
+    {
+        pattern: /\b(?:ghp|gho|ghu|ghs|ghr|glpat)-[A-Za-z0-9_]{20,}\b/g,
+        replacement: "[REDACTED: git token]",
+        label: "git-token",
+    },
+    // Generic hex tokens (32+ chars after token/secret/key labels)
+    {
+        pattern: /(?:token|secret|key)\s*[=:]\s*[0-9a-f]{32,}/gi,
+        replacement: "[REDACTED: hex token]",
+        label: "hex-token",
+    },
+];
+/**
+ * Redact sensitive data from command output.
+ *
+ * @param text - Raw stdout or stderr text
+ * @returns Sanitized text with redaction metadata
+ */
+export function redactOutput(text) {
+    if (!text)
+        return { text, redactionCount: 0, matchedPatterns: [] };
+    let result = text;
+    let redactionCount = 0;
+    const matchedPatterns = [];
+    for (const { pattern, replacement, label } of REDACTION_PATTERNS) {
+        // Reset lastIndex for global regexes
+        pattern.lastIndex = 0;
+        const matches = result.match(pattern);
+        if (matches && matches.length > 0) {
+            redactionCount += matches.length;
+            matchedPatterns.push(label);
+            result = result.replace(pattern, replacement);
+        }
+    }
+    return { text: result, redactionCount, matchedPatterns };
+}

package/build/core/tool-annotations.d.ts

@@ -0,0 +1,13 @@
+/**
+ * tool-annotations.ts — Centralized MCP ToolAnnotations for all tools.
+ *
+ * Annotations are auto-injected by the tool-wrapper proxy at registration
+ * time, so individual tool files do not need modification.
+ *
+ * @module tool-annotations
+ */
+import type { ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
+export declare const TOOL_ANNOTATIONS: Record<string, ToolAnnotations>;
+export declare function getToolAnnotations(toolName: string): ToolAnnotations | undefined;
+export declare function isReadOnlyTool(toolName: string): boolean;
+//# sourceMappingURL=tool-annotations.d.ts.map

package/build/core/tool-annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-annotations.d.ts","sourceRoot":"","sources":["../../src/core/tool-annotations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAmC5D,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEhF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/build/core/tool-annotations.js

@@ -0,0 +1,49 @@
+/**
+ * tool-annotations.ts — Centralized MCP ToolAnnotations for all tools.
+ *
+ * Annotations are auto-injected by the tool-wrapper proxy at registration
+ * time, so individual tool files do not need modification.
+ *
+ * @module tool-annotations
+ */
+export const TOOL_ANNOTATIONS = {
+    // Read-only tools (ALL actions are non-modifying)
+    secrets: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    cloud_security: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    process_security: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    api_security: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    // Destructive tools (at least one state-modifying action)
+    firewall: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    harden_kernel: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    harden_host: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    access_control: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    compliance: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    integrity: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    log_management: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    malware: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    container_docker: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    container_isolation: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    ebpf: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    crypto: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    network_defense: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    patch: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    incident_response: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    defense_mgmt: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    sudo_session: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    backup: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    supply_chain: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    zero_trust: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    honeypot_manage: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    dns_security: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    threat_intel: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    vuln_manage: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    waf_manage: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    wireless_security: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    app_harden: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+};
+export function getToolAnnotations(toolName) {
+    return TOOL_ANNOTATIONS[toolName];
+}
+export function isReadOnlyTool(toolName) {
+    return TOOL_ANNOTATIONS[toolName]?.readOnlyHint === true;
+}

package/build/core/tool-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-wrapper.d.ts","sourceRoot":"","sources":["../../src/core/tool-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAoBzE,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,cAAmB,GAC3B,SAAS,CAkDX;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}
+{"version":3,"file":"tool-wrapper.d.ts","sourceRoot":"","sources":["../../src/core/tool-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsBzE,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,cAAmB,GAC3B,SAAS,CAkDX;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}

package/build/core/tool-wrapper.js

@@ -27,6 +27,8 @@ import { PrivilegeManager } from "./privilege-manager.js";
 import { SudoGuard } from "./sudo-guard.js";
 import { SudoSession } from "./sudo-session.js";
 import { RateLimiter } from "./rate-limiter.js";
+import { getConfig } from "./config.js";
+import { getToolAnnotations, isReadOnlyTool } from "./tool-annotations.js";
 // ── Constants ────────────────────────────────────────────────────────────────
 /**
  * Tools that always skip pre-flight because they manage the sudo session
@@ -131,6 +133,16 @@ function createWrappedToolMethod(server, ctx) {
             return originalTool(...args);
         }
         const toolName = args[0];
+        // ── Tool filtering (read-only mode & allowlisting) ──────────────
+        const config = getConfig();
+        if (config.allowedTools.length > 0 && !config.allowedTools.includes(toolName)) {
+            console.error(`[tool-filter] Skipping '${toolName}' — not in DEFENSE_MCP_ALLOWED_TOOLS`);
+            return undefined;
+        }
+        if (config.readOnly && !isReadOnlyTool(toolName)) {
+            console.error(`[tool-filter] Skipping destructive tool '${toolName}' — read-only mode`);
+            return undefined;
+        }
         // ── Bypass check ─────────────────────────────────────────────────
         if (shouldBypassPreflight(toolName, ctx)) {
             return originalTool(...args);
@@ -141,6 +153,12 @@ function createWrappedToolMethod(server, ctx) {
         // Reconstruct args with the wrapped handler in the last position
         const wrappedArgs = [...args];
         wrappedArgs[wrappedArgs.length - 1] = wrappedHandler;
+        // ── Auto-inject tool annotations ────────────────────────────────
+        const annotations = getToolAnnotations(toolName);
+        if (annotations) {
+            // Insert annotations before the handler (last position)
+            wrappedArgs.splice(wrappedArgs.length - 1, 0, annotations);
+        }
         return originalTool(...wrappedArgs);
     };
 }

package/build/tools/meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../src/tools/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+5BpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAg1CzD"}
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../src/tools/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAi6BpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAu8CzD"}

package/build/tools/meta.js

@@ -14,7 +14,7 @@ import { executeCommand } from "../core/executor.js";
 import { resolveCommand, isAllowlisted } from "../core/command-allowlist.js";
 import { getConfig, getToolTimeout } from "../core/config.js";
 import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
-import { logChange, createChangeEntry, getChangelog } from "../core/changelog.js";
+import { logChange, createChangeEntry, getChangelog, verifyChangelog } from "../core/changelog.js";
 import { checkAllTools, installMissing, getInstallHint, getAlternativesMap, } from "../core/installer.js";
 import { SafeguardRegistry } from "../core/safeguards.js";
 import { listThirdPartyTools, installThirdPartyTool, getVerifiedInstallInstructions, isThirdPartyInstallEnabled, } from "../core/third-party-installer.js";
@@ -23,7 +23,9 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, statSy
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { spawnSafe } from "../core/spawn-safe.js";
-import { secureWriteFileSync } from "../core/secure-fs.js";
+import { secureWriteFileSync, verifySecurePermissions } from "../core/secure-fs.js";
+import { verifyAllBinaries } from "../core/command-allowlist.js";
+import { RateLimiter } from "../core/rate-limiter.js";
 // Suppress unused import warnings
 void getToolTimeout;
 // ── Security Posture Helpers ───────────────────────────────────────────────
@@ -804,6 +806,7 @@ export function registerMetaTools(server) {
             "report_formats",
             "check_optional_deps",
             "install_optional_deps",
+            "self_audit",
         ]).describe("Defense management action"),
         // check_tools params
         category: z.string().optional().describe("Filter by tool category"),
@@ -828,6 +831,8 @@ export function registerMetaTools(server) {
         severity_filter: z.enum(["critical", "high", "medium", "low"]).optional().default("medium").describe("Minimum severity to include"),
         session_id: z.string().optional().describe("Remediation session ID"),
         output_format: z.enum(["text", "json"]).optional().default("text").describe("Output format"),
+        // self_audit params
+        verbose: z.boolean().optional().default(false).describe("Include detailed findings in self-audit output"),
         // optional deps params
         tool_name: z.string().optional().describe("Tool binary name to install (omit for all missing)"),
         force: z.boolean().optional().default(false).describe("Force reinstall even if installed"),
@@ -2101,6 +2106,136 @@ export function registerMetaTools(server) {
                     return { content: [createErrorContent(`Optional deps installation failed: ${msg}`)], isError: true };
                 }
             }
+            // ── self_audit ──────────────────────────────────────────────────
+            case "self_audit": {
+                try {
+                    const verbose = params.verbose ?? false;
+                    const sections = [];
+                    sections.push("=== Defense MCP Self-Security Audit ===");
+                    sections.push("");
+                    let score = 0;
+                    let totalChecks = 0;
+                    let warnings = 0;
+                    // 1. State directory permissions
+                    totalChecks++;
+                    const stateDir = join(homedir(), ".defense-mcp");
+                    const stateDirs = [stateDir, join(stateDir, "backups"), join(stateDir, "quarantine"), join(stateDir, "policies")];
+                    sections.push("1. State Directory Permissions");
+                    let dirAllOk = true;
+                    for (const dir of stateDirs) {
+                        if (!existsSync(dir)) {
+                            sections.push(`   ${dir}: MISSING (not created yet)`);
+                        }
+                        else if (verifySecurePermissions(dir)) {
+                            if (verbose)
+                                sections.push(`   ${dir}: OK (0700)`);
+                        }
+                        else {
+                            sections.push(`   ${dir}: WARN — permissions too open`);
+                            dirAllOk = false;
+                        }
+                    }
+                    if (dirAllOk) {
+                        score++;
+                        sections.push("   Status: OK");
+                    }
+                    else {
+                        warnings++;
+                        sections.push("   Status: WARNING");
+                    }
+                    sections.push("");
+                    // 2. Changelog hash chain integrity
+                    totalChecks++;
+                    const clResult = verifyChangelog();
+                    sections.push("2. Changelog Integrity");
+                    sections.push(`   Total entries: ${clResult.totalEntries}`);
+                    sections.push(`   Hashed entries: ${clResult.hashedEntries}`);
+                    if (clResult.valid) {
+                        sections.push("   Chain integrity: VALID");
+                        score++;
+                    }
+                    else {
+                        sections.push(`   Chain integrity: BROKEN (${clResult.brokenLinks.length} broken link(s))`);
+                        warnings++;
+                        if (verbose) {
+                            for (const link of clResult.brokenLinks.slice(0, 5)) {
+                                sections.push(`     - Entry ${link.index} (${link.entryId})`);
+                            }
+                        }
+                    }
+                    sections.push("");
+                    // 3. Binary integrity
+                    totalChecks++;
+                    sections.push("3. Binary Integrity");
+                    try {
+                        const binResults = await verifyAllBinaries();
+                        const verified = binResults.filter(r => r.verified).length;
+                        const warnBins = binResults.filter(r => !r.verified).length;
+                        const skipped = binResults.length === 0 ? 0 : 0;
+                        sections.push(`   Verified: ${verified}, Warnings: ${warnBins}, Total: ${binResults.length}`);
+                        if (warnBins === 0) {
+                            score++;
+                            sections.push("   Status: OK");
+                        }
+                        else {
+                            warnings++;
+                            sections.push("   Status: WARNING");
+                        }
+                    }
+                    catch {
+                        sections.push("   Status: ERROR — could not verify binaries");
+                        warnings++;
+                    }
+                    sections.push("");
+                    // 4. Configuration security
+                    totalChecks++;
+                    const cfg = getConfig();
+                    sections.push("4. Configuration Security");
+                    const cfgChecks = [
+                        ["dryRun", cfg.dryRun, "safe preview mode"],
+                        ["requireConfirmation", cfg.requireConfirmation, "confirm before changes"],
+                        ["backupEnabled", cfg.backupEnabled, "backup before modify"],
+                        ["redactOutput", cfg.redactOutput, "credential redaction"],
+                    ];
+                    let cfgAllOk = true;
+                    for (const [name, value, desc] of cfgChecks) {
+                        if (value) {
+                            sections.push(`   [OK]   ${name}: true (${desc})`);
+                        }
+                        else {
+                            sections.push(`   [WARN] ${name}: false — consider enabling in production`);
+                            cfgAllOk = false;
+                        }
+                    }
+                    if (cfg.readOnly) {
+                        sections.push(`   [INFO] readOnly: true (audit-only mode)`);
+                    }
+                    else if (verbose) {
+                        sections.push(`   [INFO] readOnly: false`);
+                    }
+                    if (cfgAllOk)
+                        score++;
+                    else
+                        warnings++;
+                    sections.push("");
+                    // 5. Rate limiter status
+                    totalChecks++;
+                    const rl = RateLimiter.instance();
+                    sections.push("5. Rate Limiter");
+                    sections.push(`   Per-tool limit: ${rl.maxPerTool}/${Math.round(rl.windowMs / 1000)}s`);
+                    sections.push(`   Global limit: ${rl.maxGlobal}/${Math.round(rl.windowMs / 1000)}s`);
+                    sections.push("   Status: ACTIVE");
+                    score++;
+                    sections.push("");
+                    // Overall score
+                    sections.push(`Overall: ${score}/${totalChecks} (${warnings} warning(s))`);
+                    return { content: [createTextContent(sections.join("\n"))] };
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { content: [createErrorContent(`Self-audit failed: ${msg}`)], isError: true };
+                }
+            }
             default:
                 return { content: [createErrorContent(`Unknown action: ${action}`)], isError: true };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defense-mcp-server",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Defense MCP Server — 31 defensive security tools with 250+ actions for system hardening, compliance, and threat detection on Linux",
   "type": "module",
   "main": "build/index.js",