defense-mcp-server 0.9.2 → 0.9.3

package/build/tools/waf.js

@@ -8,7 +8,7 @@
  * configuration, OWASP CRS deployment checks, and blocked request analysis.
  */
 import { z } from "zod";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { runCommand } from "../core/run-command.js";
 import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
 // ── Constants ──────────────────────────────────────────────────────────────────
 const MODSEC_CONF_PATHS = {
@@ -40,53 +40,7 @@ const OWASP_CRS_PATHS = [
     "/opt/owasp-crs",
     "/etc/modsecurity/crs",
 ];
-/**
- * Run a command via spawnSafe and collect output as a promise.
- * Handles errors gracefully — returns error info instead of throwing.
- */
-async function runCommand(command, args, timeoutMs = 30_000) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawnSafe(command, args);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            resolve({ stdout: "", stderr: msg, exitCode: -1 });
-            return;
-        }
-        let stdout = "";
-        let stderr = "";
-        let resolved = false;
-        const timer = setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                child.kill("SIGTERM");
-                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
-            }
-        }, timeoutMs);
-        child.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-        child.on("close", (code) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr, exitCode: code ?? -1 });
-            }
-        });
-        child.on("error", (err) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr: err.message, exitCode: -1 });
-            }
-        });
-    });
-}
+// ── Helpers ────────────────────────────────────────────────────────────────────
 /**
  * Run a command via sudo through spawnSafe.
  */
@@ -101,8 +55,8 @@ async function handleModsecAudit(webServer, outputFormat) {
     try {
         const sections = [];
         const jsonData = {};
-        sections.push("🛡️ ModSecurity WAF Audit");
-        sections.push("=".repeat(55));
+        sections.push("ModSecurity WAF Audit");
+        sections.push("");
         sections.push(`Web Server: ${webServer}`);
         // Check if ModSecurity is installed
         const dpkgCheck = await runCommand("dpkg", ["-l", "libapache2-mod-security2"]);
@@ -121,12 +75,12 @@ async function handleModsecAudit(webServer, outputFormat) {
                 const testResult = await runCommand("test", ["-f", confPath]);
                 if (testResult.exitCode === 0) {
                     configFound = true;
-                    sections.push(`  ⚠️ ModSecurity package not found via dpkg, but config exists: ${confPath}`);
+                    sections.push(`  ModSecurity package not found via dpkg, but config exists: ${confPath}`);
                     break;
                 }
             }
             if (!configFound) {
-                sections.push("  ❌ ModSecurity is NOT installed");
+                sections.push("  ModSecurity is NOT installed");
                 sections.push("  Install with:");
                 if (webServer === "nginx") {
                     sections.push("    sudo apt install libnginx-mod-security");
@@ -142,7 +96,7 @@ async function handleModsecAudit(webServer, outputFormat) {
             }
         }
         else {
-            sections.push("  ✅ ModSecurity is installed");
+            sections.push("  ModSecurity is installed");
         }
         // Read ModSecurity configuration
         const confPaths = MODSEC_CONF_PATHS[webServer] || MODSEC_CONF_PATHS.nginx;
@@ -165,16 +119,16 @@ async function handleModsecAudit(webServer, outputFormat) {
             const engineMode = engineMatch ? engineMatch[1] : "unknown";
             jsonData.engine_mode = engineMode;
             if (engineMode === "On") {
-                sections.push("  ✅ SecRuleEngine: On (active protection)");
+                sections.push("  SecRuleEngine: On (active protection)");
             }
             else if (engineMode === "DetectionOnly") {
-                sections.push("  ⚠️ SecRuleEngine: DetectionOnly (logging only, not blocking)");
+                sections.push("  SecRuleEngine: DetectionOnly (logging only, not blocking)");
             }
             else if (engineMode === "Off") {
-                sections.push("  ❌ SecRuleEngine: Off (WAF disabled!)");
+                sections.push("  SecRuleEngine: Off (WAF disabled!)");
             }
             else {
-                sections.push(`  ❓ SecRuleEngine: ${engineMode}`);
+                sections.push(`  SecRuleEngine: ${engineMode}`);
             }
             // Check audit logging
             const auditLogMatch = configContent.match(/^\s*SecAuditLog\s+(\S+)/m);
@@ -210,16 +164,16 @@ async function handleModsecAudit(webServer, outputFormat) {
             }
             jsonData.issues = issues;
             if (issues.length === 0) {
-                sections.push("  ✅ No common misconfigurations detected");
+                sections.push("  No common misconfigurations detected");
             }
             else {
                 for (const issue of issues) {
-                    sections.push(`  ⚠️ ${issue}`);
+                    sections.push(`  WARNING: ${issue}`);
                 }
             }
         }
         else {
-            sections.push("  ❌ No ModSecurity configuration file found");
+            sections.push("  No ModSecurity configuration file found");
             sections.push("  Searched paths:");
             for (const p of confPaths) {
                 sections.push(`    - ${p}`);
@@ -244,8 +198,8 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
     try {
         const sections = [];
         const jsonData = {};
-        sections.push("📋 ModSecurity Rules Management");
-        sections.push("=".repeat(55));
+        sections.push("ModSecurity Rules Management");
+        sections.push("");
         switch (ruleAction) {
             case "list": {
                 sections.push("\n── Loaded Rule Files ──");
@@ -263,7 +217,7 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                         })
                             .filter((f) => f && f.endsWith(".conf"));
                         for (const file of files) {
-                            sections.push(`    📄 ${file}`);
+                            sections.push(`    ${file}`);
                             allFiles.push(`${rulesDir}/${file}`);
                         }
                         if (files.length === 0) {
@@ -274,7 +228,7 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                 jsonData.rule_files = allFiles;
                 jsonData.total_files = allFiles.length;
                 if (allFiles.length === 0) {
-                    sections.push("\n  ❌ No rule files found in standard directories");
+                    sections.push("\n  No rule files found in standard directories");
                     sections.push("  Searched:");
                     for (const d of MODSEC_RULES_DIRS) {
                         sections.push(`    - ${d}`);
@@ -318,7 +272,7 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                 const hasRemoveDirective = configContent.includes(removeDirective);
                 if (ruleAction === "disable") {
                     if (hasRemoveDirective) {
-                        sections.push(`  ℹ️ Rule ${ruleId} is already disabled`);
+                        sections.push(`  INFO: Rule ${ruleId} is already disabled`);
                         jsonData.status = "already_disabled";
                     }
                     else {
@@ -328,13 +282,13 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                             `echo '${removeDirective}' >> ${activeConfPath}`,
                         ]);
                         if (appendResult.exitCode === 0) {
-                            sections.push(`  ✅ Rule ${ruleId} disabled (added ${removeDirective})`);
+                            sections.push(`  Rule ${ruleId} disabled (added ${removeDirective})`);
                             sections.push(`  Config: ${activeConfPath}`);
-                            sections.push(`  ⚠️ Reload ${webServer} to apply: sudo systemctl reload ${webServer}`);
+                            sections.push(`  Reload ${webServer} to apply: sudo systemctl reload ${webServer}`);
                             jsonData.status = "disabled";
                         }
                         else {
-                            sections.push(`  ❌ Failed to disable rule: ${appendResult.stderr}`);
+                            sections.push(`  Failed to disable rule: ${appendResult.stderr}`);
                             jsonData.status = "error";
                             jsonData.error = appendResult.stderr;
                         }
@@ -343,7 +297,7 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                 else {
                     // enable — remove the SecRuleRemoveById directive
                     if (!hasRemoveDirective) {
-                        sections.push(`  ℹ️ Rule ${ruleId} is already enabled (no removal directive found)`);
+                        sections.push(`  INFO: Rule ${ruleId} is already enabled (no removal directive found)`);
                         jsonData.status = "already_enabled";
                     }
                     else {
@@ -353,13 +307,13 @@ async function handleModsecRules(ruleAction, ruleId, webServer, outputFormat) {
                             activeConfPath,
                         ]);
                         if (sedResult.exitCode === 0) {
-                            sections.push(`  ✅ Rule ${ruleId} enabled (removed ${removeDirective})`);
+                            sections.push(`  Rule ${ruleId} enabled (removed ${removeDirective})`);
                             sections.push(`  Config: ${activeConfPath}`);
-                            sections.push(`  ⚠️ Reload ${webServer} to apply: sudo systemctl reload ${webServer}`);
+                            sections.push(`  Reload ${webServer} to apply: sudo systemctl reload ${webServer}`);
                             jsonData.status = "enabled";
                         }
                         else {
-                            sections.push(`  ❌ Failed to enable rule: ${sedResult.stderr}`);
+                            sections.push(`  Failed to enable rule: ${sedResult.stderr}`);
                             jsonData.status = "error";
                             jsonData.error = sedResult.stderr;
                         }
@@ -390,8 +344,8 @@ async function handleRateLimitConfig(webServer, rateLimit, rateLimitZone, output
     try {
         const sections = [];
         const jsonData = {};
-        sections.push("⚡ Rate Limiting Configuration");
-        sections.push("=".repeat(55));
+        sections.push("Rate Limiting Configuration");
+        sections.push("");
         sections.push(`Web Server: ${webServer}`);
         jsonData.web_server = webServer;
         if (webServer === "nginx") {
@@ -409,24 +363,24 @@ async function handleRateLimitConfig(webServer, rateLimit, rateLimitZone, output
                 if (zoneMatches.length > 0) {
                     sections.push("  Rate limit zones defined:");
                     for (const zone of zoneMatches) {
-                        sections.push(`    📊 ${zone.trim()}`);
+                        sections.push(`    ${zone.trim()}`);
                     }
                 }
                 else {
-                    sections.push("  ❌ No limit_req_zone directives found");
+                    sections.push("  No limit_req_zone directives found");
                 }
                 if (reqMatches.length > 0) {
                     sections.push("  Rate limit enforcement:");
                     for (const req of reqMatches) {
-                        sections.push(`    🔒 ${req.trim()}`);
+                        sections.push(`    ${req.trim()}`);
                     }
                 }
                 else {
-                    sections.push("  ❌ No limit_req directives found");
+                    sections.push("  No limit_req directives found");
                 }
             }
             else {
-                sections.push("  ❌ Could not read /etc/nginx/nginx.conf");
+                sections.push("  Could not read /etc/nginx/nginx.conf");
                 jsonData.error = "Could not read nginx config";
             }
             // Suggest configuration
@@ -454,8 +408,8 @@ async function handleRateLimitConfig(webServer, rateLimit, rateLimitZone, output
             }
             jsonData.mod_ratelimit = hasRatelimit;
             jsonData.mod_evasive = hasEvasive;
-            sections.push(`  mod_ratelimit: ${hasRatelimit ? "✅ loaded" : "❌ not loaded"}`);
-            sections.push(`  mod_evasive: ${hasEvasive ? "✅ loaded" : "❌ not loaded"}`);
+            sections.push(`  mod_ratelimit: ${hasRatelimit ? "loaded" : "not loaded"}`);
+            sections.push(`  mod_evasive: ${hasEvasive ? "loaded" : "not loaded"}`);
             if (hasEvasive) {
                 const evasiveConf = await runSudoCommand("cat", ["/etc/apache2/mods-enabled/evasive.conf"]);
                 if (evasiveConf.exitCode === 0) {
@@ -502,8 +456,8 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
     try {
         const sections = [];
         const jsonData = {};
-        sections.push("🌐 OWASP Core Rule Set (CRS) Status");
-        sections.push("=".repeat(55));
+        sections.push("OWASP Core Rule Set (CRS) Status");
+        sections.push("");
         // Check if CRS is installed
         let crsPath = "";
         for (const path of OWASP_CRS_PATHS) {
@@ -516,7 +470,7 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
         jsonData.installed = !!crsPath;
         jsonData.crs_path = crsPath || null;
         if (!crsPath) {
-            sections.push("\n  ❌ OWASP CRS is NOT installed");
+            sections.push("\n  OWASP CRS is NOT installed");
             sections.push("\n── Installation Instructions ──");
             sections.push("  Option 1 — Package manager:");
             sections.push("    sudo apt install modsecurity-crs");
@@ -531,7 +485,7 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
             }
             return { content: [createTextContent(sections.join("\n"))] };
         }
-        sections.push(`\n  ✅ CRS found at: ${crsPath}`);
+        sections.push(`\n  CRS found at: ${crsPath}`);
         // Check version
         const changelogResult = await runCommand("head", ["-5", `${crsPath}/CHANGES`]);
         const versionFileResult = await runCommand("cat", [`${crsPath}/VERSION`]);
@@ -566,7 +520,7 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
             if (confContent.exitCode === 0) {
                 if (confContent.stdout.includes("modsecurity-crs") || confContent.stdout.includes("crs-setup")) {
                     integrated = true;
-                    sections.push(`  ✅ CRS Include directives found in ${confPath}`);
+                    sections.push(`  CRS Include directives found in ${confPath}`);
                     break;
                 }
             }
@@ -578,12 +532,12 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
                 : await runSudoCommand("cat", ["/etc/apache2/apache2.conf"]);
             if (mainConf.exitCode === 0 && (mainConf.stdout.includes("modsecurity-crs") || mainConf.stdout.includes("crs-setup"))) {
                 integrated = true;
-                sections.push("  ✅ CRS Include directives found in main config");
+                sections.push("  CRS Include directives found in main config");
             }
         }
         jsonData.integrated = integrated;
         if (!integrated) {
-            sections.push("  ❌ CRS Include directives NOT found in ModSecurity configuration");
+            sections.push("  CRS Include directives NOT found in ModSecurity configuration");
             sections.push("  Add these lines to your ModSecurity configuration:");
             sections.push(`    Include ${crsPath}/crs-setup.conf`);
             sections.push(`    Include ${crsPath}/rules/*.conf`);
@@ -600,7 +554,7 @@ async function handleOwaspCrsDeploy(webServer, outputFormat) {
                 .sort();
             for (const file of ruleFiles) {
                 categories.push(file);
-                sections.push(`    📄 ${file}`);
+                sections.push(`    ${file}`);
             }
         }
         jsonData.rule_categories = categories;
@@ -623,8 +577,8 @@ async function handleBlockedRequests(logPath, outputFormat) {
     try {
         const sections = [];
         const jsonData = {};
-        sections.push("🚫 WAF Blocked Requests Analysis");
-        sections.push("=".repeat(55));
+        sections.push("WAF Blocked Requests Analysis");
+        sections.push("");
         // Find the log file
         let activeLogPath = logPath;
         if (!activeLogPath) {
@@ -637,7 +591,7 @@ async function handleBlockedRequests(logPath, outputFormat) {
             }
         }
         if (!activeLogPath) {
-            sections.push("\n  ❌ No ModSecurity audit log found");
+            sections.push("\n  No ModSecurity audit log found");
             sections.push("  Searched paths:");
             for (const p of MODSEC_AUDIT_LOG_PATHS) {
                 sections.push(`    - ${p}`);
@@ -710,7 +664,7 @@ async function handleBlockedRequests(logPath, outputFormat) {
             if (fpCandidates.length > 0) {
                 sections.push("  Rules triggered excessively (may be false positives):");
                 for (const [ruleId, count] of fpCandidates) {
-                    sections.push(`    ⚠️ Rule ${ruleId}: ${count} hits — review for tuning`);
+                    sections.push(`    Rule ${ruleId}: ${count} hits — review for tuning`);
                 }
             }
             else {

package/build/tools/wireless-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wireless-security.d.ts","sourceRoot":"","sources":["../../src/tools/wireless-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6GpE;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAkC5E;AA+jBD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAyQrE"}
+{"version":3,"file":"wireless-security.d.ts","sourceRoot":"","sources":["../../src/tools/wireless-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+CpE;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAkC5E;AA+jBD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAyQrE"}

package/build/tools/wireless-security.js

@@ -9,7 +9,7 @@
  * wireless interface disabling with kernel module blacklist recommendations.
  */
 import { z } from "zod";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { runCommand } from "../core/run-command.js";
 import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
 import { existsSync, readFileSync } from "node:fs";
 // ── Constants ──────────────────────────────────────────────────────────────────
@@ -17,53 +17,7 @@ import { existsSync, readFileSync } from "node:fs";
 const KNOWN_APS_PATH = "/var/lib/defense-mcp/wireless/known-aps.json";
 /** Wireless kernel modules that can be blacklisted */
 const WIRELESS_MODULES = ["bluetooth", "btusb", "iwlwifi", "ath9k", "ath10k_pci", "rt2800usb"];
-/**
- * Run a command via spawnSafe and collect output as a promise.
- * Handles errors gracefully — returns error info instead of throwing.
- */
-async function runCommand(command, args, timeoutMs = 30_000) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawnSafe(command, args);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            resolve({ stdout: "", stderr: msg, exitCode: -1 });
-            return;
-        }
-        let stdout = "";
-        let stderr = "";
-        let resolved = false;
-        const timer = setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                child.kill("SIGTERM");
-                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
-            }
-        }, timeoutMs);
-        child.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-        child.on("close", (code) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr, exitCode: code ?? -1 });
-            }
-        });
-        child.on("error", (err) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr: err.message, exitCode: -1 });
-            }
-        });
-    });
-}
+// ── Helpers ────────────────────────────────────────────────────────────────────
 /**
  * Load known APs from the configuration file.
  * Returns empty array if file doesn't exist or is invalid.
@@ -632,8 +586,8 @@ export function registerWirelessSecurityTools(server) {
                     let text = "Wireless Security — Bluetooth Audit\n\n";
                     text += `Adapter Found: ${audit.adapterFound ? "yes" : "no"}\n`;
                     text += `Adapter Status: ${audit.adapterStatus}\n`;
-                    text += `Powered: ${audit.powered ? "YES ⚠" : "no"}\n`;
-                    text += `Discoverable: ${audit.discoverable ? "YES ⚠⚠" : "no ✓"}\n`;
+                    text += `Powered: ${audit.powered ? "YES WARNING" : "no"}\n`;
+                    text += `Discoverable: ${audit.discoverable ? "YES WARNING" : "no OK"}\n`;
                     text += `Paired Devices: ${audit.pairedDevicesCount}\n`;
                     if (audit.pairedDevices.length > 0) {
                         text += "\nPaired Devices:\n";
@@ -641,7 +595,7 @@ export function registerWirelessSecurityTools(server) {
                             text += `  • ${dev}\n`;
                         }
                     }
-                    text += `\nBluetooth Service: ${audit.serviceRunning ? "running ⚠" : "not running ✓"}\n`;
+                    text += `\nBluetooth Service: ${audit.serviceRunning ? "running WARNING" : "not running OK"}\n`;
                     text += `Risk Level: ${audit.riskLevel}\n`;
                     if (audit.recommendations.length > 0) {
                         text += "\nRecommendations:\n";
@@ -743,7 +697,7 @@ export function registerWirelessSecurityTools(server) {
                         }
                     }
                     if (scan.potentialEvilTwins.length > 0) {
-                        text += "\n⚠ Potential Evil Twins:\n";
+                        text += "\nWARNING: Potential Evil Twins:\n";
                         for (const twin of scan.potentialEvilTwins) {
                             text += `  • SSID: ${twin.ap.ssid} | BSSID: ${twin.ap.bssid} — mimics known AP: ${twin.matchedKnown}\n`;
                         }
@@ -789,8 +743,8 @@ export function registerWirelessSecurityTools(server) {
                             const status = wi.inUse
                                 ? "IN USE (not disabled)"
                                 : wi.disabled
-                                    ? "DISABLED ✓"
-                                    : "could not disable ⚠";
+                                    ? "DISABLED OK"
+                                    : "could not disable WARNING";
                             text += `  • ${wi.name}: ${status}\n`;
                         }
                     }
@@ -800,7 +754,7 @@ export function registerWirelessSecurityTools(server) {
                     }
                     else {
                         for (const mod of disable.loadedModules) {
-                            text += `  • ${mod.name}: ${mod.loaded ? "LOADED" : "not loaded"}${mod.canBlacklist ? " ⚠ can be blacklisted" : ""}\n`;
+                            text += `  • ${mod.name}: ${mod.loaded ? "LOADED" : "not loaded"}${mod.canBlacklist ? " WARNING: can be blacklisted" : ""}\n`;
                         }
                     }
                     text += `\nInterfaces Disabled: ${disable.interfacesDisabled}\n`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "defense-mcp-server",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "description": "Defense MCP Server — 31 defensive security tools with 250+ actions for system hardening, compliance, and threat detection on Linux",
   "type": "module",
   "main": "build/index.js",
@@ -25,6 +25,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "knip": "knip",
     "lint:security": "eslint src/ --max-warnings=0",
     "audit:security": "npm audit --audit-level=high",
     "changelog:check": "git diff HEAD~1 --name-only | grep -q CHANGELOG.md || echo 'Warning: CHANGELOG.md not updated'",
@@ -83,15 +84,16 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "@eslint/js": "~9.39.4",
     "@types/node": "~22.19.11",
     "@vitest/coverage-v8": "~4.0.18",
     "eslint": "~9.39.4",
     "eslint-plugin-security": "~3.0.1",
     "husky": "~9.1.7",
+    "knip": "^6.2.0",
     "license-checker": "~25.0.1",
     "tsx": "~4.21.0",
     "typescript": "~5.9.3",
+    "typescript-eslint": "^8.58.0",
     "vitest": "~4.0.18"
   }
 }