defense-mcp-server 0.9.2 → 0.9.3

package/build/tools/container-security.js

@@ -86,8 +86,8 @@ export function registerContainerSecurityTools(server) {
                 const { check_type } = params;
                 try {
                     const sections = [];
-                    sections.push("🐳 Docker Security Audit");
-                    sections.push("=".repeat(50));
+                    sections.push("Docker Security Audit");
+                    sections.push("");
                     const findings = [];
                     const dockerCheck = await executeCommand({ command: "which", args: ["docker"], toolName: "container_docker", timeout: 5000 });
                     if (dockerCheck.exitCode !== 0) {
@@ -199,14 +199,13 @@ export function registerContainerSecurityTools(server) {
                     }
                     sections.push("\n── Security Findings Summary ──");
                     if (findings.length === 0) {
-                        sections.push("  ✅ No significant security issues found.");
+                        sections.push("  No significant security issues found.");
                     }
                     else {
                         for (const lvl of ["CRITICAL", "WARNING", "INFO"]) {
                             const items = findings.filter((f) => f.level === lvl);
                             if (items.length > 0) {
-                                const icon = lvl === "CRITICAL" ? "⛔" : lvl === "WARNING" ? "⚠️" : "ℹ️";
-                                sections.push(`\n  ${icon} ${lvl} (${items.length}):`);
+                                sections.push(`\n  ${lvl} (${items.length}):`);
                                 for (const f of items)
                                     sections.push(`    - ${f.msg}`);
                             }
@@ -222,7 +221,7 @@ export function registerContainerSecurityTools(server) {
             case "bench": {
                 const { checks: benchChecks, log_level } = params;
                 try {
-                    const sections = ["🔒 Docker Bench for Security", "=".repeat(50)];
+                    const sections = ["Docker Bench for Security", ""];
                     const dockerCheck = await executeCommand({ command: "which", args: ["docker"], toolName: "container_docker", timeout: 5000 });
                     if (dockerCheck.exitCode !== 0)
                         return { content: [createTextContent("Docker is not installed.")] };
@@ -234,7 +233,7 @@ export function registerContainerSecurityTools(server) {
                     const result = await executeCommand({ command: "docker", args: benchArgs, toolName: "container_docker", timeout: 300000 });
                     const output = result.stdout || result.stderr;
                     if (result.exitCode !== 0 && !output) {
-                        sections.push("⚠️ Docker Bench could not run.");
+                        sections.push("Docker Bench could not run.");
                         return { content: [createTextContent(sections.join("\n"))] };
                     }
                     const levelPriority = { PASS: 0, INFO: 1, NOTE: 2, WARN: 3 };
@@ -296,7 +295,7 @@ export function registerContainerSecurityTools(server) {
                             note: unconfined ? "seccomp explicitly disabled — HIGH RISK" : !hasSeccomp && secOpt === "[]" ? "Using Docker default seccomp (acceptable)" : "seccomp configured",
                         });
                     }
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: results.length, pass: results.filter(r => r.status === "PASS").length, warn: results.filter(r => r.status === "WARN").length, fail: results.filter(r => r.status === "FAIL").length }, containers: results }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: results.length, pass: results.filter(r => r.status === "PASS").length, warn: results.filter(r => r.status === "WARN").length, fail: results.filter(r => r.status === "FAIL").length }, containers: results }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -308,13 +307,13 @@ export function registerContainerSecurityTools(server) {
                 try {
                     if (!daemon_action)
                         return { content: [createErrorContent("daemon_action is required (audit or apply)")], isError: true };
-                    const sections = ["🐳 Docker Daemon Configuration", "=".repeat(50)];
+                    const sections = ["Docker Daemon Configuration", ""];
                     const daemonPath = "/etc/docker/daemon.json";
                     const readResult = await executeCommand({ command: "cat", args: [daemonPath], toolName: "container_docker", timeout: 5000 });
                     const existingConfig = readResult.exitCode === 0 ? parseJsonSafe(readResult.stdout) || {} : {};
                     if (daemon_action === "audit") {
                         if (readResult.exitCode !== 0)
-                            sections.push("  ⚠️ No /etc/docker/daemon.json found");
+                            sections.push("  No /etc/docker/daemon.json found");
                         else
                             sections.push(`  ${JSON.stringify(existingConfig, null, 4).replace(/\n/g, "\n  ")}`);
                         sections.push("\n── Security Settings Audit ──");
@@ -331,7 +330,7 @@ export function registerContainerSecurityTools(server) {
                         for (const c of checks) {
                             if (!c.present)
                                 missingCount++;
-                            sections.push(`  ${c.present ? "✅ Present" : "❌ Missing"}: ${c.key} [${c.severity}]`);
+                            sections.push(`  ${c.present ? "Present" : "Missing"}: ${c.key} [${c.severity}]`);
                         }
                         sections.push(`\n  Summary: ${checks.length - missingCount}/${checks.length} configured`);
                         return { content: [createTextContent(sections.join("\n"))] };
@@ -402,13 +401,13 @@ export function registerContainerSecurityTools(server) {
                     else {
                         if (readResult.exitCode === 0) {
                             await backupFile(daemonPath);
-                            sections.push(`\n  ✅ Backed up ${daemonPath}`);
+                            sections.push(`\n  Backed up ${daemonPath}`);
                         }
                         const writeResult = await executeCommand({ command: "sudo", args: ["tee", daemonPath], stdin: newJson, toolName: "container_docker", timeout: 10000 });
                         if (writeResult.exitCode !== 0)
                             return { content: [createErrorContent(`Failed to write ${daemonPath}: ${writeResult.stderr}`)], isError: true };
-                        sections.push(`  ✅ Written to ${daemonPath}`);
-                        sections.push("\n  ⚠️ Restart Docker: sudo systemctl restart docker");
+                        sections.push(`  Written to ${daemonPath}`);
+                        sections.push("\n  Restart Docker: sudo systemctl restart docker");
                         logChange(createChangeEntry({ tool: "container_docker", action: "apply daemon config", target: daemonPath, before: JSON.stringify(existingConfig), after: newJson, dryRun: false, success: true }));
                     }
                     return { content: [createTextContent(sections.join("\n"))] };
@@ -434,7 +433,7 @@ export function registerContainerSecurityTools(server) {
                     const grypeResult = await executeCommand({ command: "grype", args: [image, "-o", "json"], timeout: 300000, toolName: "container_docker" });
                     if (grypeResult.exitCode === 0)
                         return { content: [createTextContent(`Grype scan results for ${image}:\n${grypeResult.stdout.substring(0, 8000)}`)] };
-                    return { content: [createTextContent(JSON.stringify({ error: "Neither Trivy nor Grype is installed", recommendation: "Install Trivy or Grype" }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ error: "Neither Trivy nor Grype is installed", recommendation: "Install Trivy or Grype" }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -493,7 +492,7 @@ export function registerContainerSecurityTools(server) {
             // ── apparmor_status ─────────────────────────────────────────
             case "apparmor_status": {
                 try {
-                    const sections = ["🛡️ AppArmor System Status", "=".repeat(40)];
+                    const sections = ["AppArmor System Status", ""];
                     const enabledResult = await executeCommand({ command: "aa-enabled", args: [], toolName: "container_isolation", timeout: 5000 });
                     const aaEnabledBin = enabledResult.exitCode === 0 && enabledResult.stdout.trim() === "Yes";
                     const moduleResult = await executeCommand({ command: "cat", args: ["/sys/module/apparmor/parameters/enabled"], toolName: "container_isolation", timeout: 5000 });
@@ -503,15 +502,15 @@ export function registerContainerSecurityTools(server) {
                     const svcActive = svcResult.exitCode === 0 && svcResult.stdout.trim() === "active";
                     // AppArmor is considered enabled if aa-enabled says "Yes", OR if kernel module is loaded AND service is active
                     const aaEnabled = aaEnabledBin || (kernelModuleLoaded && svcActive);
-                    sections.push(`\n  AppArmor enabled: ${aaEnabled ? "✅ Yes" : "❌ No"}`);
+                    sections.push(`\n  AppArmor enabled: ${aaEnabled ? "Yes" : "No"}`);
                     if (moduleResult.exitCode === 0)
-                        sections.push(`  Kernel module: ${kernelModuleLoaded ? "✅ Loaded" : "❌ Not loaded"}`);
+                        sections.push(`  Kernel module: ${kernelModuleLoaded ? "Loaded" : "Not loaded"}`);
                     const pkgChecks = ["apparmor-profiles", "apparmor-profiles-extra", "apparmor-utils"];
                     sections.push("\n  Profile Packages:");
                     for (const pkg of pkgChecks) {
                         const dpkgResult = await executeCommand({ command: "dpkg", args: ["-s", pkg], toolName: "container_isolation", timeout: 5000 });
                         const installed = dpkgResult.exitCode === 0 && dpkgResult.stdout.includes("Status: install ok installed");
-                        sections.push(`    ${pkg}: ${installed ? "✅ Installed" : "❌ Not installed"}`);
+                        sections.push(`    ${pkg}: ${installed ? "Installed" : "Not installed"}`);
                     }
                     return { content: [createTextContent(sections.join("\n"))] };
                 }
@@ -522,12 +521,12 @@ export function registerContainerSecurityTools(server) {
             // ── apparmor_list ───────────────────────────────────────────
             case "apparmor_list": {
                 try {
-                    const sections = ["🛡️ AppArmor Profiles", "=".repeat(40)];
+                    const sections = ["AppArmor Profiles", ""];
                     let result = await executeCommand({ command: "sudo", args: ["aa-status"], toolName: "container_isolation", timeout: getToolTimeout("container_apparmor_manage") });
                     if (result.exitCode !== 0)
                         result = await executeCommand({ command: "sudo", args: ["apparmor_status"], toolName: "container_isolation", timeout: getToolTimeout("container_apparmor_manage") });
                     if (result.exitCode !== 0) {
-                        sections.push("\n⚠️ Cannot list AppArmor profiles.");
+                        sections.push("\nCannot list AppArmor profiles.");
                         return { content: [createTextContent(sections.join("\n"))] };
                     }
                     const output = result.stdout;
@@ -537,15 +536,15 @@ export function registerContainerSecurityTools(server) {
                         const trimmed = line.trim();
                         if (trimmed.includes("enforce mode")) {
                             currentSection = "enforce";
-                            sections.push("\n  🔒 Enforce Mode:");
+                            sections.push("\n  Enforce Mode:");
                         }
                         else if (trimmed.includes("complain mode")) {
                             currentSection = "complain";
-                            sections.push("\n  📝 Complain Mode:");
+                            sections.push("\n  Complain Mode:");
                         }
                         else if (trimmed.includes("unconfined")) {
                             currentSection = "unconfined";
-                            sections.push("\n  ⚠️ Unconfined:");
+                            sections.push("\n  Unconfined:");
                         }
                         else if (currentSection && trimmed && !trimmed.match(/^\d+\s+processes?/)) {
                             sections.push(`    ${trimmed}`);
@@ -574,7 +573,7 @@ export function registerContainerSecurityTools(server) {
                     const isDesktopProfile = DESKTOP_BREAKING_PROFILES.has(profileBaseName);
                     // SAFETY: Warn when enforcing profiles known to break desktop apps
                     const desktopWarning = (baseAction === "enforce" && isDesktopProfile)
-                        ? `\n\n⚠️ WARNING: Profile '${profileBaseName}' is known to break desktop applications ` +
+                        ? `\n\nWARNING: Profile '${profileBaseName}' is known to break desktop applications ` +
                             `(flatpak, browsers, GUI apps) when enforced.\n` +
                             `These profiles use ABI 4.0 default-deny and block shared library loading.\n` +
                             `This may prevent Chromium, Firefox, Flatpak apps, and similar from launching.\n` +
@@ -587,7 +586,7 @@ export function registerContainerSecurityTools(server) {
                     if (result.exitCode !== 0)
                         return { content: [createErrorContent(`Failed to ${baseAction} profile '${profile}': ${result.stderr}`)], isError: true };
                     logChange(createChangeEntry({ tool: "container_isolation", action: baseAction, target: profile, after: `${baseAction} mode`, dryRun: false, success: true, rollbackCommand: baseAction === "disable" ? `sudo aa-enforce ${profile}` : baseAction === "enforce" ? `sudo aa-complain ${profile}` : undefined }));
-                    return { content: [createTextContent(`✅ Profile '${profile}' set to ${baseAction} mode.\n${result.stdout || result.stderr}${desktopWarning}`)] };
+                    return { content: [createTextContent(`Profile '${profile}' set to ${baseAction} mode.\n${result.stdout || result.stderr}${desktopWarning}`)] };
                 }
                 catch (err) {
                     return { content: [createErrorContent(err instanceof Error ? err.message : String(err))], isError: true };
@@ -602,7 +601,7 @@ export function registerContainerSecurityTools(server) {
                     if (isDryRun) {
                         return { content: [createTextContent(`[DRY RUN] Would install: ${packages.join(", ")}\n` +
                                     `  Command: sudo apt-get install -y ${packages.join(" ")}\n\n` +
-                                    `⚠️ After installation, the following profiles will be set to COMPLAIN mode\n` +
+                                    `After installation, the following profiles will be set to COMPLAIN mode\n` +
                                     `to prevent breaking desktop applications (flatpak, browsers, etc.):\n` +
                                     `  ${[...DESKTOP_BREAKING_PROFILES].join(", ")}\n\n` +
                                     `Use apparmor_enforce to selectively enforce profiles after testing.`)] };
@@ -621,18 +620,18 @@ export function registerContainerSecurityTools(server) {
                         if (checkResult.exitCode === 0) {
                             const complainResult = await executeCommand({ command: "sudo", args: ["aa-complain", profilePath], toolName: "container_isolation", timeout: 10000 });
                             if (complainResult.exitCode === 0) {
-                                complainResults.push(`  ✓ ${profileName} → complain mode`);
+                                complainResults.push(`  OK ${profileName} → complain mode`);
                             }
                             else {
-                                complainResults.push(`  ✗ ${profileName} → failed: ${complainResult.stderr.trim()}`);
+                                complainResults.push(`  FAIL ${profileName} → failed: ${complainResult.stderr.trim()}`);
                             }
                         }
                     }
                     const complainSection = complainResults.length > 0
-                        ? `\n\n⚠️ Desktop-safe profiles set to complain mode (prevents breaking GUI apps):\n${complainResults.join("\n")}\n\nUse apparmor_enforce to selectively enforce profiles after testing.`
+                        ? `\n\nDesktop-safe profiles set to complain mode (prevents breaking GUI apps):\n${complainResults.join("\n")}\n\nUse apparmor_enforce to selectively enforce profiles after testing.`
                         : "";
                     logChange(createChangeEntry({ tool: "container_isolation", action: "install_profiles", target: packages.join(", "), after: `installed; ${complainResults.length} profiles set to complain`, dryRun: false, success: true, rollbackCommand: `sudo apt-get remove -y ${packages.join(" ")}` }));
-                    return { content: [createTextContent(`✅ Successfully installed: ${packages.join(", ")}${complainSection}`)] };
+                    return { content: [createTextContent(`Successfully installed: ${packages.join(", ")}${complainSection}`)] };
                 }
                 catch (err) {
                     return { content: [createErrorContent(err instanceof Error ? err.message : String(err))], isError: true };
@@ -665,10 +664,10 @@ export function registerContainerSecurityTools(server) {
             // ── selinux_status ──────────────────────────────────────────
             case "selinux_status": {
                 try {
-                    const sections = [`🛡️ SELinux Management: status`, "=".repeat(40)];
+                    const sections = [`SELinux Management: status`, ""];
                     const result = await executeCommand({ command: "sestatus", args: [], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                     if (result.exitCode !== 0) {
-                        sections.push("\n⚠️ SELinux may not be installed.");
+                        sections.push("\nSELinux may not be installed.");
                         sections.push(result.stderr || result.stdout);
                     }
                     else
@@ -682,10 +681,10 @@ export function registerContainerSecurityTools(server) {
             // ── selinux_getenforce ──────────────────────────────────────
             case "selinux_getenforce": {
                 try {
-                    const sections = [`🛡️ SELinux Management: getenforce`, "=".repeat(40)];
+                    const sections = [`SELinux Management: getenforce`, ""];
                     const result = await executeCommand({ command: "getenforce", args: [], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                     if (result.exitCode !== 0)
-                        sections.push("\n⚠️ getenforce not available.");
+                        sections.push("\ngetenforce not available.");
                     else
                         sections.push(`\nCurrent SELinux mode: ${result.stdout.trim()}`);
                     return { content: [createTextContent(sections.join("\n"))] };
@@ -698,11 +697,11 @@ export function registerContainerSecurityTools(server) {
             case "selinux_setenforce": {
                 const { mode, dry_run } = params;
                 try {
-                    const sections = [`🛡️ SELinux Management: setenforce`, "=".repeat(40)];
+                    const sections = [`SELinux Management: setenforce`, ""];
                     if (!mode)
                         return { content: [createErrorContent("mode is required for selinux_setenforce")], isError: true };
                     if (mode === "disabled") {
-                        sections.push("\n⚠️ Cannot disable SELinux at runtime.");
+                        sections.push("\nCannot disable SELinux at runtime.");
                         return { content: [createTextContent(sections.join("\n"))] };
                     }
                     const modeValue = mode === "enforcing" ? "1" : "0";
@@ -713,7 +712,7 @@ export function registerContainerSecurityTools(server) {
                     const result = await executeCommand({ command: "sudo", args: ["setenforce", modeValue], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                     if (result.exitCode !== 0)
                         return { content: [createErrorContent(`Failed: ${result.stderr}`)], isError: true };
-                    sections.push(`\n✅ SELinux mode set to ${mode}.`);
+                    sections.push(`\nSELinux mode set to ${mode}.`);
                     logChange(createChangeEntry({ tool: "container_isolation", action: "setenforce", target: "SELinux", after: mode, dryRun: false, success: true, rollbackCommand: `sudo setenforce ${mode === "enforcing" ? "0" : "1"}` }));
                     return { content: [createTextContent(sections.join("\n"))] };
                 }
@@ -725,7 +724,7 @@ export function registerContainerSecurityTools(server) {
             case "selinux_booleans": {
                 const { boolean_name, boolean_value, dry_run } = params;
                 try {
-                    const sections = [`🛡️ SELinux Management: booleans`, "=".repeat(40)];
+                    const sections = [`SELinux Management: booleans`, ""];
                     if (boolean_name && boolean_value) {
                         sanitizeArgs([boolean_name]);
                         if (dry_run ?? getConfig().dryRun) {
@@ -735,7 +734,7 @@ export function registerContainerSecurityTools(server) {
                         const result = await executeCommand({ command: "sudo", args: ["setsebool", "-P", boolean_name, boolean_value], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                         if (result.exitCode !== 0)
                             return { content: [createErrorContent(`Failed: ${result.stderr}`)], isError: true };
-                        sections.push(`\n✅ Boolean '${boolean_name}' set to ${boolean_value}.`);
+                        sections.push(`\nBoolean '${boolean_name}' set to ${boolean_value}.`);
                         logChange(createChangeEntry({ tool: "container_isolation", action: "set_boolean", target: boolean_name, after: boolean_value, dryRun: false, success: true, rollbackCommand: `sudo setsebool -P ${boolean_name} ${boolean_value === "on" ? "off" : "on"}` }));
                     }
                     else if (boolean_name) {
@@ -748,7 +747,7 @@ export function registerContainerSecurityTools(server) {
                     else {
                         const result = await executeCommand({ command: "getsebool", args: ["-a"], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                         if (result.exitCode !== 0)
-                            sections.push("\n⚠️ Cannot list booleans.");
+                            sections.push("\nCannot list booleans.");
                         else
                             sections.push(result.stdout);
                     }
@@ -761,14 +760,14 @@ export function registerContainerSecurityTools(server) {
             // ── selinux_audit ───────────────────────────────────────────
             case "selinux_audit": {
                 try {
-                    const sections = [`🛡️ SELinux Management: audit`, "=".repeat(40)];
+                    const sections = [`SELinux Management: audit`, ""];
                     const result = await executeCommand({ command: "sudo", args: ["ausearch", "-m", "AVC", "-ts", "recent"], toolName: "container_isolation", timeout: getToolTimeout("container_selinux_manage") });
                     if (result.exitCode !== 0 && (result.stderr.includes("no matches") || result.stdout.includes("no matches")))
-                        sections.push("\n✅ No recent SELinux AVC denials.");
+                        sections.push("\nNo recent SELinux AVC denials.");
                     else if (result.exitCode !== 0)
-                        sections.push("\n⚠️ Could not search audit logs.");
+                        sections.push("\nCould not search audit logs.");
                     else
-                        sections.push(`\n⚠️ Recent SELinux AVC Denials:\n${result.stdout}`);
+                        sections.push(`\nWARNING: Recent SELinux AVC Denials:\n${result.stdout}`);
                     return { content: [createTextContent(sections.join("\n"))] };
                 }
                 catch (err) {
@@ -779,7 +778,7 @@ export function registerContainerSecurityTools(server) {
             case "namespace_check": {
                 const { pid, check_type } = params;
                 try {
-                    const sections = ["📦 Namespace Isolation Check", "=".repeat(40)];
+                    const sections = ["Namespace Isolation Check", ""];
                     if (pid !== undefined) {
                         sections.push(`\nProcess PID: ${pid}`);
                         const nsResult = await executeCommand({ command: "ls", args: ["-la", `/proc/${pid}/ns/`], toolName: "container_isolation", timeout: getToolTimeout("container_namespace_check") });
@@ -791,16 +790,16 @@ export function registerContainerSecurityTools(server) {
                     else {
                         sections.push("\n── System Namespace Configuration ──");
                         if (check_type === "user" || check_type === "all") {
-                            sections.push("\n🔑 User Namespaces:");
+                            sections.push("\nUser Namespaces:");
                             const maxNsResult = await executeCommand({ command: "cat", args: ["/proc/sys/user/max_user_namespaces"], toolName: "container_isolation", timeout: 5000 });
                             if (maxNsResult.exitCode === 0) {
                                 const maxNs = maxNsResult.stdout.trim();
                                 sections.push(`  max_user_namespaces: ${maxNs}`);
-                                sections.push(maxNs === "0" ? "  ⚠️ User namespaces are disabled" : "  ✅ User namespaces are enabled");
+                                sections.push(maxNs === "0" ? "  WARNING: User namespaces are disabled" : "  User namespaces are enabled");
                             }
                         }
                         if (check_type === "network" || check_type === "all") {
-                            sections.push("\n🌐 Network Namespaces:");
+                            sections.push("\nNetwork Namespaces:");
                             const netnsResult = await executeCommand({ command: "ip", args: ["netns", "list"], toolName: "container_isolation", timeout: getToolTimeout("container_namespace_check") });
                             if (netnsResult.exitCode === 0 && netnsResult.stdout.trim()) {
                                 const namespaces = netnsResult.stdout.trim().split("\n").filter((l) => l.trim());
@@ -812,17 +811,17 @@ export function registerContainerSecurityTools(server) {
                                 sections.push("  No named network namespaces found.");
                         }
                         if (check_type === "all" || check_type === "pid") {
-                            sections.push("\n📋 All Active Namespaces (lsns):");
+                            sections.push("\nAll Active Namespaces (lsns):");
                             let lsnsResult = await executeCommand({ command: "lsns", args: [], toolName: "container_isolation", timeout: getToolTimeout("container_namespace_check") });
                             if (lsnsResult.exitCode !== 0)
                                 lsnsResult = await executeCommand({ command: "sudo", args: ["lsns"], toolName: "container_isolation", timeout: getToolTimeout("container_namespace_check") });
                             if (lsnsResult.exitCode === 0)
                                 sections.push(lsnsResult.stdout);
                             else
-                                sections.push("  ⚠️ Cannot list namespaces.");
+                                sections.push("  Cannot list namespaces.");
                         }
                         if (check_type === "mount" || check_type === "all") {
-                            sections.push("\n📁 Mount Namespace Info:");
+                            sections.push("\nMount Namespace Info:");
                             const mountInfoResult = await executeCommand({ command: "cat", args: ["/proc/self/mountinfo"], toolName: "container_isolation", timeout: 5000 });
                             if (mountInfoResult.exitCode === 0)
                                 sections.push(`  Current mount namespace has ${mountInfoResult.stdout.trim().split("\n").length} mount points`);

package/build/tools/deception.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deception.d.ts","sourceRoot":"","sources":["../../src/tools/deception.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAorBpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2R9D"}
+{"version":3,"file":"deception.d.ts","sourceRoot":"","sources":["../../src/tools/deception.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAsnBpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA2R9D"}

package/build/tools/deception.js

@@ -10,7 +10,7 @@
  */
 import { z } from "zod";
 import * as crypto from "node:crypto";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { runCommand } from "../core/run-command.js";
 import { secureWriteFileSync } from "../core/secure-fs.js";
 import { createTextContent, createErrorContent, formatToolOutput, } from "../core/parsers.js";
 import { existsSync, readFileSync, unlinkSync, rmSync } from "node:fs";
@@ -19,53 +19,7 @@ import { existsSync, readFileSync, unlinkSync, rmSync } from "node:fs";
 const CANARY_BASE_DIR = "/var/lib/defense-mcp/canaries";
 /** Path to the canary registry file */
 const REGISTRY_PATH = `${CANARY_BASE_DIR}/registry.json`;
-/**
- * Run a command via spawnSafe and collect output as a promise.
- * Handles errors gracefully — returns error info instead of throwing.
- */
-async function runCommand(command, args, timeoutMs = 30_000) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawnSafe(command, args);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            resolve({ stdout: "", stderr: msg, exitCode: -1 });
-            return;
-        }
-        let stdout = "";
-        let stderr = "";
-        let resolved = false;
-        const timer = setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                child.kill("SIGTERM");
-                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
-            }
-        }, timeoutMs);
-        child.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-        child.on("close", (code) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr, exitCode: code ?? -1 });
-            }
-        });
-        child.on("error", (err) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr: err.message, exitCode: -1 });
-            }
-        });
-    });
-}
+// ── Helpers ────────────────────────────────────────────────────────────────────
 /**
  * Generate a unique canary ID based on timestamp and cryptographic random suffix.
  */
@@ -572,7 +526,7 @@ export function registerDeceptionTools(server) {
                     text += `Canary ID: ${deployResult.canaryId}\n`;
                     text += `Type: ${deployResult.type}\n`;
                     text += `Path: ${deployResult.path}\n`;
-                    text += `Monitoring: ${deployResult.monitoringSetup ? "active ✓" : "not set up ⚠"}\n`;
+                    text += `Monitoring: ${deployResult.monitoringSetup ? "active OK" : "not set up WARNING"}\n`;
                     text += `Details: ${deployResult.monitoringDetails}\n`;
                     text += `\n${deployResult.description}\n`;
                     return { content: [createTextContent(text)] };
@@ -610,7 +564,7 @@ export function registerDeceptionTools(server) {
                     text += `Port: ${honeyResult.port}\n`;
                     text += `Listener PID: ${honeyResult.listenerPid ?? "unknown"}\n`;
                     text += `Log Path: ${honeyResult.logPath}\n`;
-                    text += `Iptables LOG Rule: ${honeyResult.iptablesRuleAdded ? "added ✓" : "not added ⚠"}\n`;
+                    text += `Iptables LOG Rule: ${honeyResult.iptablesRuleAdded ? "added OK" : "not added WARNING"}\n`;
                     text += `\n${honeyResult.description}\n`;
                     return { content: [createTextContent(text)] };
                 }
@@ -639,7 +593,7 @@ export function registerDeceptionTools(server) {
                     text += `Triggered: ${triggerResult.triggeredCount}\n`;
                     text += `Not Triggered: ${triggerResult.notTriggered.length}\n\n`;
                     if (triggerResult.triggered.length > 0) {
-                        text += "⚠ TRIGGERED CANARIES:\n";
+                        text += "WARNING: TRIGGERED CANARIES:\n";
                         for (const t of triggerResult.triggered) {
                             text += `\n  • ${t.id} [${t.type}] — Severity: ${t.severity}\n`;
                             if (t.path)
@@ -699,12 +653,12 @@ export function registerDeceptionTools(server) {
                     }
                     else {
                         text += `Canary ID: ${removeResult.canaryId}\n`;
-                        text += `File/Directory Removed: ${removeResult.fileRemoved ? "yes ✓" : "no"}\n`;
+                        text += `File/Directory Removed: ${removeResult.fileRemoved ? "yes OK" : "no"}\n`;
                         if (removeResult.listenerKilled) {
-                            text += `Listener Killed: yes ✓\n`;
+                            text += `Listener Killed: yes OK\n`;
                         }
                         if (removeResult.iptablesRemoved) {
-                            text += `Iptables Rule Removed: yes ✓\n`;
+                            text += `Iptables Rule Removed: yes OK\n`;
                         }
                         text += `\n${removeResult.description}\n`;
                     }

package/build/tools/dns-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns-security.d.ts","sourceRoot":"","sources":["../../src/tools/dns-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAmHpE;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkB3D;AAID,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4DjF;AAID,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,GACvB;IAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CA4DxI;AAID,UAAU,iBAAiB;IACzB,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,iBAAiB,CAyEhG;AAID,UAAU,gBAAgB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,oBAAoB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAyFpE;AAID,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwZhE"}
+{"version":3,"file":"dns-security.d.ts","sourceRoot":"","sources":["../../src/tools/dns-security.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqDpE;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkB3D;AAID,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4DjF;AAID,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,GACvB;IAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CA4DxI;AAID,UAAU,iBAAiB;IACzB,WAAW,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,iBAAiB,CAyEhG;AAID,UAAU,gBAAgB;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,oBAAoB,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAyFpE;AAID,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwZhE"}

package/build/tools/dns-security.js

@@ -8,7 +8,7 @@
  * DNS tunneling detection, domain blocking, and query log analysis.
  */
 import { z } from "zod";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { runCommand } from "../core/run-command.js";
 import { secureWriteFileSync, secureCopyFileSync } from "../core/secure-fs.js";
 import { createErrorContent, formatToolOutput, } from "../core/parsers.js";
 import { validateInterface } from "../core/sanitizer.js";
@@ -34,53 +34,7 @@ const SUSPICIOUS_TLDS = new Set([
 const MAX_CAPTURE_DURATION = 120;
 /** Default entropy threshold for tunneling detection */
 const DEFAULT_ENTROPY_THRESHOLD = 3.5;
-/**
- * Run a command via spawnSafe and collect output as a promise.
- * Handles errors gracefully — returns error info instead of throwing.
- */
-async function runCommand(command, args, timeoutMs = 30_000) {
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawnSafe(command, args);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            resolve({ stdout: "", stderr: msg, exitCode: -1 });
-            return;
-        }
-        let stdout = "";
-        let stderr = "";
-        let resolved = false;
-        const timer = setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                child.kill("SIGTERM");
-                resolve({ stdout, stderr: stderr + "\n[TIMEOUT]", exitCode: -1 });
-            }
-        }, timeoutMs);
-        child.stdout?.on("data", (data) => {
-            stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-            stderr += data.toString();
-        });
-        child.on("close", (code) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr, exitCode: code ?? -1 });
-            }
-        });
-        child.on("error", (err) => {
-            if (!resolved) {
-                resolved = true;
-                clearTimeout(timer);
-                resolve({ stdout, stderr: err.message, exitCode: -1 });
-            }
-        });
-    });
-}
+// ── Helpers ────────────────────────────────────────────────────────────────────
 /**
  * Run a command via sudo through spawnSafe.
  */

package/build/tools/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/tools/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAqJpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAgnD/D"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/tools/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAoJpE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CA+mD/D"}