defense-mcp-server 0.9.2 → 0.9.3

package/build/tools/app-hardening.js

@@ -454,8 +454,8 @@ export function registerAppHardeningTools(server) {
             case "audit": {
                 try {
                     const sections = [];
-                    sections.push("🔍 Application Security Audit");
-                    sections.push("=".repeat(55));
+                    sections.push("Application Security Audit");
+                    sections.push("");
                     const apps = await detectRunningApps();
                     if (apps.length === 0) {
                         sections.push("\nNo known applications detected.");
@@ -467,9 +467,7 @@ export function registerAppHardeningTools(server) {
                     apps.sort((a, b) => riskOrder[a.profile.riskLevel] - riskOrder[b.profile.riskLevel]);
                     let totalRisks = 0;
                     for (const app of apps) {
-                        const riskIcon = app.profile.riskLevel === "critical" ? "⛔" :
-                            app.profile.riskLevel === "high" ? "🔴" : app.profile.riskLevel === "medium" ? "🟡" : "🟢";
-                        sections.push(`── ${riskIcon} ${app.profile.name} ──`);
+                        sections.push(`── ${app.profile.name} ──`);
                         sections.push(`  Category:     ${app.profile.category}`);
                         sections.push(`  Risk Level:   ${app.profile.riskLevel.toUpperCase()}`);
                         sections.push(`  Running as:   ${app.user}`);
@@ -480,17 +478,17 @@ export function registerAppHardeningTools(server) {
                             sections.push(`  Listening Ports:`);
                             for (const lp of app.listenPorts) {
                                 const external = !lp.address.includes("127.0.0.1") && !lp.address.includes("::1");
-                                sections.push(`    ${lp.protocol}/${lp.port} on ${lp.address} [${external ? "⚠️ EXTERNAL" : "✅ localhost"}]`);
+                                sections.push(`    ${lp.protocol}/${lp.port} on ${lp.address} [${external ? "WARNING: EXTERNAL" : "localhost"}]`);
                             }
                         }
                         sections.push(`  Security Concerns:`);
                         for (const concern of app.profile.securityConcerns) {
-                            sections.push(`    ⚠️ ${concern}`);
+                            sections.push(`    WARNING: ${concern}`);
                             totalRisks++;
                         }
                         sections.push(`  Top Recommendations:`);
                         for (const rec of app.profile.recommendations.slice(0, 3)) {
-                            sections.push(`    💡 ${rec}`);
+                            sections.push(`    ${rec}`);
                         }
                         if (app.profile.recommendations.length > 3) {
                             sections.push(`    ... +${app.profile.recommendations.length - 3} more (use action=recommend)`);
@@ -530,24 +528,24 @@ export function registerAppHardeningTools(server) {
                         };
                     }
                     const sections = [];
-                    sections.push(`🛡️ Hardening Guide: ${profile.name}`);
-                    sections.push("=".repeat(55));
+                    sections.push(`Hardening Guide: ${profile.name}`);
+                    sections.push("");
                     sections.push(`Category: ${profile.category} | Risk: ${profile.riskLevel.toUpperCase()}`);
                     sections.push("\n── Security Concerns ──");
                     for (const concern of profile.securityConcerns) {
-                        sections.push(`  ⚠️ ${concern}`);
+                        sections.push(`  WARNING: ${concern}`);
                     }
                     sections.push("\n── Network Hardening ──");
                     if (profile.requiredPorts.length > 0) {
                         sections.push("  Ports that MUST remain open (core functionality):");
                         for (const p of profile.requiredPorts) {
-                            sections.push(`    ✅ ${p.protocol}/${p.port} — ${p.purpose}`);
+                            sections.push(`    ${p.protocol}/${p.port} — ${p.purpose}`);
                         }
                     }
                     if (profile.localhostOnlyPorts.length > 0) {
                         sections.push("  Ports to restrict to localhost/LAN:");
                         for (const p of profile.localhostOnlyPorts) {
-                            sections.push(`    🔒 ${p.protocol}/${p.port} — ${p.purpose}`);
+                            sections.push(`    ${p.protocol}/${p.port} — ${p.purpose}`);
                         }
                     }
                     sections.push("  Firewall strategy:");
@@ -571,11 +569,11 @@ export function registerAppHardeningTools(server) {
                     sections.push("\n── Filesystem Permissions ──");
                     sections.push("  Writable paths (required for operation):");
                     for (const p of profile.writablePaths) {
-                        sections.push(`    📝 ${p}`);
+                        sections.push(`    ${p}`);
                     }
                     sections.push("  Read-only paths:");
                     for (const p of profile.readablePaths) {
-                        sections.push(`    📖 ${p}`);
+                        sections.push(`    ${p}`);
                     }
                     return { content: [createTextContent(sections.join("\n"))] };
                 }
@@ -600,8 +598,8 @@ export function registerAppHardeningTools(server) {
                     }
                     const effectiveDryRun = dry_run ?? getConfig().dryRun;
                     const sections = [];
-                    sections.push(`🔥 Firewall Rules for ${profile.name}`);
-                    sections.push("=".repeat(55));
+                    sections.push(`Firewall Rules for ${profile.name}`);
+                    sections.push("");
                     sections.push(`LAN CIDR: ${lan_cidr}`);
                     sections.push(effectiveDryRun ? "\n[DRY RUN] Rules that would be applied:\n" : "\nApplying rules:\n");
                     const rules = [];
@@ -632,7 +630,7 @@ export function registerAppHardeningTools(server) {
                             else
                                 failed++;
                         }
-                        sections.push(`\n✅ Applied ${applied} rules, ❌ ${failed} failed`);
+                        sections.push(`\nApplied ${applied} rules, ${failed} failed`);
                     }
                     sections.push("\n── Additional Recommendations ──");
                     sections.push("  • Consider using nftables for more granular control");
@@ -690,10 +688,10 @@ export function registerAppHardeningTools(server) {
                         }
                     }
                     const sections = [];
-                    sections.push(`🔒 Systemd Hardening: ${profile.name}`);
-                    sections.push("=".repeat(55));
+                    sections.push(`Systemd Hardening: ${profile.name}`);
+                    sections.push("");
                     if (!svcName) {
-                        sections.push(`\n⚠️ No running systemd service found for ${profile.name}.`);
+                        sections.push(`\nWARNING: No running systemd service found for ${profile.name}.`);
                         sections.push("Provide service_name manually if the service uses a different name.");
                         sections.push("\nRecommended override content for when the service is configured:\n");
                     }
@@ -726,12 +724,12 @@ export function registerAppHardeningTools(server) {
                         });
                         if (writeResult.exitCode === 0) {
                             await executeCommand({ toolName: "app_hardening", command: "sudo", args: ["systemctl", "daemon-reload"], timeout: 10000 });
-                            sections.push(`\n✅ Override written to ${overridePath}`);
-                            sections.push("✅ systemd daemon reloaded");
-                            sections.push(`\n⚠️ Restart the service to apply: sudo systemctl restart ${svcName}`);
+                            sections.push(`\nOverride written to ${overridePath}`);
+                            sections.push("systemd daemon reloaded");
+                            sections.push(`\nRestart the service to apply: sudo systemctl restart ${svcName}`);
                         }
                         else {
-                            sections.push(`\n❌ Failed to write override: ${writeResult.stderr}`);
+                            sections.push(`\nFailed to write override: ${writeResult.stderr}`);
                         }
                     }
                     sections.push("\n── What These Directives Do ──");

package/build/tools/cloud-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-security.d.ts","sourceRoot":"","sources":["../../src/tools/cloud-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuGpE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AA4fD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6RlE"}
+{"version":3,"file":"cloud-security.d.ts","sourceRoot":"","sources":["../../src/tools/cloud-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyCpE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AA4fD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6RlE"}

package/build/tools/cloud-security.js

@@ -8,7 +8,7 @@
  * exposure checking, storage audit, and IMDS security assessment for AWS/GCP/Azure.
  */
 import { z } from "zod";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { runCommand } from "../core/run-command.js";
 import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
 import { existsSync } from "node:fs";
 /** Sensitive environment variable names for cloud credentials */
@@ -30,53 +30,7 @@ const CREDENTIAL_FILE_PATHS = [
     { provider: "gcp", path: "~/.config/gcloud/application_default_credentials.json" },
     { provider: "azure", path: "~/.azure/accessTokens.json" },
 ];
-/**
- * Run a command via spawnSafe and collect output as a promise.
- * Handles errors gracefully — returns error info instead of throwing.
- */
-async function runCommand(command, args, timeoutMs = 30_000) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawnSafe(command, args);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            resolve({ stdout: "", stderr: msg, exitCode: -1 });
-            return;
-        }
-        let stdout = "";
-        let stderr = "";
-        let resolved = false;
-        const timer = setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                child.kill("SIGTERM");
-                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
-            }
-        }, timeoutMs);
-        child.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-        child.on("close", (code) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr, exitCode: code ?? -1 });
-            }
-        });
-        child.on("error", (err) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr: err.message, exitCode: -1 });
-            }
-        });
-    });
-}
+// ── Helpers ────────────────────────────────────────────────────────────────────
 // ── Credential masking ─────────────────────────────────────────────────────────
 /**
  * Mask a credential value, showing first 4 chars + asterisks.
@@ -611,7 +565,7 @@ export function registerCloudSecurityTools(server) {
                     text += "Credential Files:\n";
                     for (const file of creds.credentialFiles) {
                         const status = file.exists
-                            ? `EXISTS (permissions: ${file.permissions || "unknown"})${file.permWarning ? ` ⚠ ${file.permWarning}` : ""}`
+                            ? `EXISTS (permissions: ${file.permissions || "unknown"})${file.permWarning ? ` WARNING: ${file.permWarning}` : ""}`
                             : "not found";
                         text += `  • ${file.path}: ${status}\n`;
                     }
@@ -706,10 +660,10 @@ export function registerCloudSecurityTools(server) {
                         return { content: [formatToolOutput(output)] };
                     }
                     let text = "Cloud Security — IMDS Security Check\n\n";
-                    text += `IMDSv1 (unauthenticated): ${imds.v1Accessible ? "ACCESSIBLE ⚠" : "not accessible ✓"}\n`;
+                    text += `IMDSv1 (unauthenticated): ${imds.v1Accessible ? "ACCESSIBLE WARNING" : "not accessible OK"}\n`;
                     text += `IMDSv2 (token-based): ${imds.v2Accessible ? "accessible" : "not accessible"}\n`;
                     text += `IMDSv2 Token Endpoint: ${imds.v2TokenWorks ? "working" : "not working"}\n`;
-                    text += `Iptables IMDS Rules: ${imds.iptablesBlocked ? "BLOCKED ✓" : imds.iptablesRules.length > 0 ? "rules found" : "no rules"}\n`;
+                    text += `Iptables IMDS Rules: ${imds.iptablesBlocked ? "BLOCKED OK" : imds.iptablesRules.length > 0 ? "rules found" : "no rules"}\n`;
                     text += `Hop Limit: ${imds.hopLimit}\n`;
                     text += `\nSeverity: ${imds.severity}\n`;
                     text += `Security Score: ${imds.securityScore}/100\n`;

package/build/tools/compliance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compliance.d.ts","sourceRoot":"","sources":["../../src/tools/compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsdpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA0iC/D"}
+{"version":3,"file":"compliance.d.ts","sourceRoot":"","sources":["../../src/tools/compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsdpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsiC/D"}

package/build/tools/compliance.js

@@ -14,7 +14,7 @@ import { generateDurationBanner, generateTimingSummary, startTiming, } from "../
 import { logChange, createChangeEntry } from "../core/changelog.js";
 import { getDistroAdapter } from "../core/distro-adapter.js";
 import { sanitizeArgs } from "../core/sanitizer.js";
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { loadPolicy, evaluatePolicy, getBuiltinPolicies, } from "../core/policy-engine.js";
 async function runCisCheck(command, args, id, title, level, expectPattern) {
     try {
@@ -668,7 +668,7 @@ export function registerComplianceTools(server) {
                     }
                     function filePermCheckLocal(filePath, maxPerm) {
                         try {
-                            const { statSync } = require("node:fs");
+                            // statSync imported at module level
                             const stat = statSync(filePath);
                             const mode = (stat.mode & 0o777).toString(8);
                             return { passed: parseInt(mode, 8) <= parseInt(maxPerm, 8), detail: `${filePath}: ${mode} (max: ${maxPerm})` };
@@ -943,21 +943,17 @@ export function registerComplianceTools(server) {
                         for (const section of report.sections) {
                             md += `## ${section.name}\n\n`;
                             md += `**Score:** ${section.score}/100\n\n`;
-                            md += `\`\`\`json\n${JSON.stringify(section.details, null, 2)}\n\`\`\`\n\n`;
+                            md += `\`\`\`json\n${JSON.stringify(section.details)}\n\`\`\`\n\n`;
                         }
                         return { content: [createTextContent(md)] };
                     }
                     // Text format
-                    let text = `${"=".repeat(60)}\n`;
-                    text += `  COMPLIANCE REPORT\n`;
-                    text += `  Generated: ${report.timestamp}\n`;
-                    text += `  Overall Score: ${report.overallScore}/100\n`;
-                    text += `${"=".repeat(60)}\n\n`;
+                    let text = `COMPLIANCE REPORT\n`;
+                    text += `Generated: ${report.timestamp}\n`;
+                    text += `Overall Score: ${report.overallScore}/100\n\n`;
                     for (const section of report.sections) {
-                        text += `${"─".repeat(50)}\n`;
-                        text += `  ${section.name} — Score: ${section.score}/100\n`;
-                        text += `${"─".repeat(50)}\n`;
-                        text += `${JSON.stringify(section.details, null, 2)}\n\n`;
+                        text += `${section.name} — Score: ${section.score}/100\n`;
+                        text += `${JSON.stringify(section.details)}\n\n`;
                     }
                     return { content: [createTextContent(text)] };
                 }
@@ -981,7 +977,7 @@ export function registerComplianceTools(server) {
                     const currentUser = process.env.USER || process.env.LOGNAME;
                     if (currentUser && currentUser !== "root" && !allowed_users.includes(currentUser)) {
                         allowed_users = [...allowed_users, currentUser];
-                        changes.push(`⚠️ Auto-included current user '${currentUser}' in allowed_users to prevent self-lockout`);
+                        changes.push(`WARNING: Auto-included current user '${currentUser}' in allowed_users to prevent self-lockout`);
                     }
                     // Validate usernames
                     for (const user of allowed_users) {

package/build/tools/container-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-security.d.ts","sourceRoot":"","sources":["../../src/tools/container-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAwBpE,eAAO,MAAM,yBAAyB,aAyBpC,CAAC;AAIH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA6vBtE"}
+{"version":3,"file":"container-security.d.ts","sourceRoot":"","sources":["../../src/tools/container-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAwBpE,eAAO,MAAM,yBAAyB,aAyBpC,CAAC;AAIH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA4vBtE"}