defense-mcp-server 0.9.2 → 0.9.4

package/build/tools/firewall.js

@@ -45,6 +45,123 @@ const CHAIN_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_-]{0,28}$/;
 // ── nftables table name regex ──────────────────────────────────────────────
 // TOOL-008: Added table name validation
 const NFTABLES_TABLE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
+// ── Nftables detection helper ─────────────────────────────────────────────
+/**
+ * Detect whether nftables is the active firewall backend on this system.
+ * Returns { active: true, reason } if nftables is managing the firewall,
+ * meaning iptables-persistent / UFW should NOT be installed on top of it.
+ */
+async function detectNftablesActive() {
+    // 1. Check if nftables service is running
+    const svcResult = await executeCommand({
+        command: "systemctl",
+        args: ["is-active", "nftables"],
+        toolName: "firewall",
+        timeout: 5000,
+    });
+    const nftServiceActive = svcResult.stdout.trim() === "active";
+    // 2. Check if nft binary exists and has a non-trivial ruleset
+    const nftResult = await executeCommand({
+        command: "sudo",
+        args: ["nft", "list", "ruleset"],
+        toolName: "firewall",
+        timeout: 10000,
+    });
+    const hasNftRules = nftResult.exitCode === 0 &&
+        nftResult.stdout.trim().length > 50 &&
+        nftResult.stdout.includes("chain ");
+    // 3. Check if nftables is enabled at boot
+    const enabledResult = await executeCommand({
+        command: "systemctl",
+        args: ["is-enabled", "nftables"],
+        toolName: "firewall",
+        timeout: 5000,
+    });
+    const nftEnabled = enabledResult.stdout.trim() === "enabled";
+    if (nftServiceActive && hasNftRules) {
+        return { active: true, reason: "nftables service is running with active rules" };
+    }
+    if (hasNftRules && nftEnabled) {
+        return { active: true, reason: "nftables is enabled at boot with active rules" };
+    }
+    if (hasNftRules) {
+        return { active: true, reason: "nftables has active rules loaded" };
+    }
+    if (nftServiceActive) {
+        return { active: true, reason: "nftables service is running" };
+    }
+    return { active: false, reason: "nftables is not active" };
+}
+async function discoverActivePorts() {
+    const ports = [];
+    const seen = new Set();
+    // Discover listening TCP/UDP ports
+    const listenResult = await executeCommand({
+        command: "sudo",
+        args: ["ss", "-tlnpH"],
+        toolName: "firewall",
+        timeout: 10000,
+    });
+    if (listenResult.exitCode === 0) {
+        for (const line of listenResult.stdout.split("\n")) {
+            // Format: LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=...))
+            const match = line.match(/:(\d+)\s+[\d.*:]+\s+users:\(\("([^"]+)"/);
+            if (match) {
+                const port = parseInt(match[1], 10);
+                const process = match[2];
+                const key = `tcp:${port}:listen`;
+                if (!seen.has(key) && port >= 1 && port <= 65535) {
+                    seen.add(key);
+                    ports.push({ protocol: "tcp", port, process, direction: "listen" });
+                }
+            }
+        }
+    }
+    const listenUdpResult = await executeCommand({
+        command: "sudo",
+        args: ["ss", "-ulnpH"],
+        toolName: "firewall",
+        timeout: 10000,
+    });
+    if (listenUdpResult.exitCode === 0) {
+        for (const line of listenUdpResult.stdout.split("\n")) {
+            const match = line.match(/:(\d+)\s+[\d.*:]+\s+users:\(\("([^"]+)"/);
+            if (match) {
+                const port = parseInt(match[1], 10);
+                const process = match[2];
+                const key = `udp:${port}:listen`;
+                if (!seen.has(key) && port >= 1 && port <= 65535) {
+                    seen.add(key);
+                    ports.push({ protocol: "udp", port, process, direction: "listen" });
+                }
+            }
+        }
+    }
+    // Discover established outbound connections (remote ports programs are talking to)
+    const estResult = await executeCommand({
+        command: "sudo",
+        args: ["ss", "-tnpH", "state", "established"],
+        toolName: "firewall",
+        timeout: 10000,
+    });
+    if (estResult.exitCode === 0) {
+        for (const line of estResult.stdout.split("\n")) {
+            // Format: ESTAB 0 0 192.168.1.5:54321 1.2.3.4:443 users:(("curl",pid=...))
+            // We want the remote port (destination) to allow outbound traffic to it
+            const match = line.match(/\s+[\d.]+:\d+\s+[\d.]+:(\d+)\s+users:\(\("([^"]+)"/);
+            if (match) {
+                const port = parseInt(match[1], 10);
+                const process = match[2];
+                const key = `tcp:${port}:established-out`;
+                if (!seen.has(key) && port >= 1 && port <= 65535) {
+                    seen.add(key);
+                    ports.push({ protocol: "tcp", port, process, direction: "established-out" });
+                }
+            }
+        }
+    }
+    return ports;
+}
 // ── Registration entry point ───────────────────────────────────────────────
 export function registerFirewallTools(server) {
     server.tool("firewall", "Firewall: iptables, UFW, nftables, persistence, policy audit", {
@@ -487,6 +604,7 @@ export function registerFirewallTools(server) {
                     }
                     const fullCmd = `sudo iptables -P ${chain} ${policy}`;
                     const ipv6Cmd = `sudo ip6tables -P ${chain} ${policy}`;
+                    const injectedRules = [];
                     // ── SAFETY CHECK: Prevent DROP policy without essential allow rules ──
                     if (policy === "DROP" && (chain === "INPUT" || chain === "FORWARD" || chain === "OUTPUT")) {
                         const safetyRules = [];
@@ -547,7 +665,6 @@ export function registerFirewallTools(server) {
                                 addArgs6: ["-I", "OUTPUT", "6", "-p", "tcp", "--dport", "80", "-j", "ACCEPT"],
                             });
                         }
-                        const injectedRules = [];
                         for (const rule of safetyRules) {
                             const checkResult = await executeCommand({
                                 command: "sudo",
@@ -575,7 +692,7 @@ export function registerFirewallTools(server) {
                                             isError: true,
                                         };
                                     }
-                                    injectedRules.push(`✅ Auto-added: ${rule.description}`);
+                                    injectedRules.push(`Auto-added: ${rule.description}`);
                                     if (ipv6 && rule.addArgs6) {
                                         const add6Result = await executeCommand({
                                             command: "sudo",
@@ -584,10 +701,10 @@ export function registerFirewallTools(server) {
                                             timeout: getToolTimeout("firewall"),
                                         });
                                         if (add6Result.exitCode !== 0) {
-                                            injectedRules.push(`⚠️ IPv6: Failed to add "${rule.description}": ${add6Result.stderr}`);
+                                            injectedRules.push(`IPv6: Failed to add "${rule.description}": ${add6Result.stderr}`);
                                         }
                                         else {
-                                            injectedRules.push(`✅ Auto-added (IPv6): ${rule.description}`);
+                                            injectedRules.push(`Auto-added (IPv6): ${rule.description}`);
                                         }
                                     }
                                 }
@@ -604,11 +721,97 @@ export function registerFirewallTools(server) {
                             });
                             logChange(safetyEntry);
                         }
+                        // ── AUTO-DISCOVER running services and allow their ports ──
+                        // This prevents killing active programs (qbittorrent, apt, etc.)
+                        const activePorts = await discoverActivePorts();
+                        const serviceRules = [];
+                        // Deduplicate: skip ports already covered by hardcoded safety rules
+                        const hardcodedPorts = new Set(["tcp:53", "udp:53", "tcp:80", "tcp:443"]);
+                        for (const ap of activePorts) {
+                            const portKey = `${ap.protocol}:${ap.port}`;
+                            if (hardcodedPorts.has(portKey))
+                                continue;
+                            if (chain === "INPUT" && ap.direction === "listen") {
+                                // Allow inbound to listening ports
+                                const checkArgs = ["-C", "INPUT", "-p", ap.protocol, "--dport", String(ap.port), "-j", "ACCEPT"];
+                                const addArgs = ["-A", "INPUT", "-p", ap.protocol, "--dport", String(ap.port), "-j", "ACCEPT"];
+                                const checkR = await executeCommand({
+                                    command: "sudo", args: ["iptables", ...checkArgs],
+                                    toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                });
+                                if (checkR.exitCode !== 0) {
+                                    if (dry_run ?? getConfig().dryRun) {
+                                        serviceRules.push(`[DRY-RUN] Would allow INPUT ${ap.protocol}/${ap.port} (${ap.process})`);
+                                    }
+                                    else {
+                                        const addR = await executeCommand({
+                                            command: "sudo", args: ["iptables", ...addArgs],
+                                            toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                        });
+                                        if (addR.exitCode === 0) {
+                                            serviceRules.push(`Auto-allowed INPUT ${ap.protocol}/${ap.port} (${ap.process})`);
+                                            if (ipv6) {
+                                                await executeCommand({
+                                                    command: "sudo", args: ["ip6tables", ...addArgs],
+                                                    toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                                });
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                            else if (chain === "OUTPUT" && (ap.direction === "listen" || ap.direction === "established-out")) {
+                                // Allow outbound to remote ports that programs are actively using
+                                const dportOrSport = ap.direction === "listen" ? "--sport" : "--dport";
+                                const checkArgs = ["-C", "OUTPUT", "-p", ap.protocol, dportOrSport, String(ap.port), "-j", "ACCEPT"];
+                                const addArgs = ["-A", "OUTPUT", "-p", ap.protocol, dportOrSport, String(ap.port), "-j", "ACCEPT"];
+                                const checkR = await executeCommand({
+                                    command: "sudo", args: ["iptables", ...checkArgs],
+                                    toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                });
+                                if (checkR.exitCode !== 0) {
+                                    if (dry_run ?? getConfig().dryRun) {
+                                        serviceRules.push(`[DRY-RUN] Would allow OUTPUT ${ap.protocol}/${dportOrSport.replace("--", "")} ${ap.port} (${ap.process})`);
+                                    }
+                                    else {
+                                        const addR = await executeCommand({
+                                            command: "sudo", args: ["iptables", ...addArgs],
+                                            toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                        });
+                                        if (addR.exitCode === 0) {
+                                            serviceRules.push(`Auto-allowed OUTPUT ${ap.protocol}/${dportOrSport.replace("--", "")} ${ap.port} (${ap.process})`);
+                                            if (ipv6) {
+                                                await executeCommand({
+                                                    command: "sudo", args: ["ip6tables", ...addArgs],
+                                                    toolName: "firewall", timeout: getToolTimeout("firewall"),
+                                                });
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                        if (serviceRules.length > 0) {
+                            injectedRules.push(...serviceRules);
+                            const serviceEntry = createChangeEntry({
+                                tool: "firewall",
+                                action: `Safety: auto-allowed ${serviceRules.length} active service ports before ${chain} DROP`,
+                                target: chain,
+                                after: serviceRules.join("; "),
+                                dryRun: !!(dry_run ?? getConfig().dryRun),
+                                success: true,
+                            });
+                            logChange(serviceEntry);
+                        }
                     }
                     if (dry_run ?? getConfig().dryRun) {
                         const cmds = [fullCmd];
                         if (ipv6)
                             cmds.push(ipv6Cmd);
+                        // Include discovered service rules in dry-run output
+                        const injectedSummary = injectedRules.length > 0
+                            ? `\n\nSafety rules that would be added first:\n  ${injectedRules.join("\n  ")}`
+                            : "";
                         const entry = createChangeEntry({
                             tool: "firewall",
                             action: `[DRY-RUN] Set ${chain} policy to ${policy}`,
@@ -620,7 +823,7 @@ export function registerFirewallTools(server) {
                         logChange(entry);
                         return {
                             content: [
-                                createTextContent(`[DRY-RUN] Would execute:\n  ${cmds.join("\n  ")}`),
+                                createTextContent(`[DRY-RUN] Would execute:\n  ${cmds.join("\n  ")}${injectedSummary}`),
                             ],
                         };
                     }
@@ -794,6 +997,26 @@ export function registerFirewallTools(server) {
             // ── ufw_status ────────────────────────────────────────────────
             case "ufw_status": {
                 try {
+                    // Check if nftables is managing firewall directly (not via UFW backend)
+                    const nftCheckStatus = await detectNftablesActive();
+                    if (nftCheckStatus.active) {
+                        // Check if UFW is even installed
+                        const ufwCheck = await executeCommand({
+                            command: "which",
+                            args: ["ufw"],
+                            toolName: "firewall",
+                            timeout: 5000,
+                        });
+                        if (ufwCheck.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createTextContent(`UFW is not installed. This system is using nftables directly (${nftCheckStatus.reason}). ` +
+                                        `Use firewall action=nftables_list to view current rules. ` +
+                                        `Installing UFW on a system with active nftables rules is not recommended as it may conflict.`),
+                                ],
+                            };
+                        }
+                    }
                     const args = ["ufw", "status"];
                     if (params.verbose) {
                         args.push("verbose");
@@ -823,6 +1046,27 @@ export function registerFirewallTools(server) {
             case "ufw_add":
             case "ufw_delete": {
                 try {
+                    // Guard: refuse UFW rule changes if nftables is active and UFW is not installed
+                    const nftCheckUfw = await detectNftablesActive();
+                    if (nftCheckUfw.active) {
+                        const ufwInstalled = await executeCommand({
+                            command: "which",
+                            args: ["ufw"],
+                            toolName: "firewall",
+                            timeout: 5000,
+                        });
+                        if (ufwInstalled.exitCode !== 0) {
+                            return {
+                                content: [
+                                    createErrorContent(`Cannot ${action === "ufw_add" ? "add" : "delete"} UFW rule: UFW is not installed and ` +
+                                        `this system is using nftables directly (${nftCheckUfw.reason}). ` +
+                                        `Installing UFW on a system with active nftables rules can conflict and break networking. ` +
+                                        `Manage firewall rules via nftables instead.`),
+                                ],
+                                isError: true,
+                            };
+                        }
+                    }
                     if (!params.rule_action) {
                         return { content: [createErrorContent("Error: 'rule_action' is required for add/delete actions (allow, deny, reject, limit)")], isError: true };
                     }
@@ -1118,6 +1362,20 @@ export function registerFirewallTools(server) {
             case "persist_enable": {
                 const dry_run = params.dry_run;
                 try {
+                    // Guard: refuse to install iptables-persistent if nftables is active
+                    const nftCheck = await detectNftablesActive();
+                    if (nftCheck.active) {
+                        return {
+                            content: [
+                                createErrorContent(`Cannot enable iptables persistence: ${nftCheck.reason}. ` +
+                                    `Installing iptables-persistent on a system using nftables can conflict ` +
+                                    `and break networking. Use nftables native persistence instead ` +
+                                    `(nft rules are typically persisted via /etc/nftables.conf and the nftables systemd service). ` +
+                                    `To view current nftables rules, use: firewall action=nftables_list`),
+                            ],
+                            isError: true,
+                        };
+                    }
                     const da = await getDistroAdapter();
                     const fwp = da.fwPersistence;
                     const installDesc = `sudo ${fwp.installCmd.join(" ")}`;
@@ -1249,7 +1507,7 @@ export function registerFirewallTools(server) {
                                 : "Persistence is properly configured",
                     };
                     return {
-                        content: [createTextContent(JSON.stringify(status, null, 2))],
+                        content: [createTextContent(JSON.stringify(status))],
                     };
                 }
                 catch (err) {
@@ -1335,9 +1593,34 @@ export function registerFirewallTools(server) {
                         const ruleCount = (output.match(/^[A-Z]+\s/gm) || []).length;
                         findings.push({ check: "iptables_rule_count", status: ruleCount > 0 ? "INFO" : "WARN", value: String(ruleCount), description: "Total iptables rules" });
                     }
-                    // Check UFW status — distinguish "not installed" from "command failed"
+                    // Check firewall backend — detect nftables vs UFW vs neither
+                    const nftAuditCheck = await detectNftablesActive();
                     const ufwWhich = await executeCommand({ command: "which", args: ["ufw"], timeout: 5000, toolName: "firewall" });
-                    if (ufwWhich.exitCode === 0) {
+                    if (nftAuditCheck.active) {
+                        // nftables is the active backend
+                        findings.push({
+                            check: "nftables_active",
+                            status: "PASS",
+                            value: `active (${nftAuditCheck.reason})`,
+                            description: "Firewall active via nftables",
+                        });
+                        if (ufwWhich.exitCode === 0) {
+                            // UFW is also installed — check if it's using nftables backend
+                            const ufwResult = await executeCommand({ command: "sudo", args: ["ufw", "status"], timeout: 10000, toolName: "firewall" });
+                            if (ufwResult.exitCode === 0 && ufwResult.stdout.includes("Status: active")) {
+                                findings.push({ check: "ufw_active", status: "INFO", value: "active (alongside nftables)", description: "UFW is active — likely using nftables backend" });
+                            }
+                        }
+                        else {
+                            findings.push({
+                                check: "ufw_not_needed",
+                                status: "INFO",
+                                value: "not installed",
+                                description: "UFW is not installed — not needed since nftables is managing the firewall. Do NOT install UFW as it may conflict.",
+                            });
+                        }
+                    }
+                    else if (ufwWhich.exitCode === 0) {
                         // UFW binary exists — try to get status
                         const ufwResult = await executeCommand({ command: "sudo", args: ["ufw", "status"], timeout: 10000, toolName: "firewall" });
                         if (ufwResult.exitCode === 0) {
@@ -1357,14 +1640,8 @@ export function registerFirewallTools(server) {
                         }
                     }
                     else {
-                        // UFW binary not found — check if nftables has rules directly
-                        const nftDirect = await executeCommand({ command: "sudo", args: ["nft", "list", "ruleset"], timeout: 10000, toolName: "firewall" });
-                        if (nftDirect.exitCode === 0 && nftDirect.stdout.trim().length > 50) {
-                            findings.push({ check: "nftables_active", status: "PASS", value: "active (nftables native)", description: "Firewall active via nftables (no UFW)" });
-                        }
-                        else {
-                            findings.push({ check: "ufw_installed", status: "FAIL", value: "not installed", description: "No firewall detected (UFW not found, nftables empty)" });
-                        }
+                        // Neither nftables nor UFW active
+                        findings.push({ check: "firewall_missing", status: "FAIL", value: "not installed", description: "No firewall detected (UFW not found, nftables not active)", recommendation: "Install and configure a firewall (nftables recommended for modern systems)" });
                     }
                     // Check ip6tables
                     const ip6Result = await executeCommand({ command: "sudo", args: ["ip6tables", "-L", "-n"], timeout: 10000, toolName: "firewall" });
@@ -1383,23 +1660,40 @@ export function registerFirewallTools(server) {
                             });
                         }
                     }
-                    // Check for firewall persistence (distro-aware)
+                    // Check for firewall persistence (distro-aware, nftables-aware)
                     const daPolicy = await getDistroAdapter();
-                    const fwpPolicy = daPolicy.fwPersistence;
-                    const persistResult = await executeCommand({ command: fwpPolicy.checkInstalledCmd[0], args: fwpPolicy.checkInstalledCmd.slice(1), timeout: 5000, toolName: "firewall" });
-                    const persistInstalled = daPolicy.isDebian ? persistResult.stdout.includes("ii") : persistResult.exitCode === 0;
-                    findings.push({
-                        check: "firewall_persistence",
-                        status: persistInstalled ? "PASS" : "WARN",
-                        value: persistInstalled ? "installed" : "not installed",
-                        description: `${fwpPolicy.packageName} (rules survive reboot)`,
-                        recommendation: persistInstalled
-                            ? undefined
-                            : "Use firewall with action='persist_enable' to install and activate persistence, then action='persist_save' to persist current rules",
-                    });
+                    if (nftAuditCheck.active) {
+                        // nftables persistence is via nftables.conf + systemd service
+                        const nftConfExists = await executeCommand({ command: "test", args: ["-f", "/etc/nftables.conf"], timeout: 3000, toolName: "firewall" });
+                        const nftSvcEnabled = await executeCommand({ command: "systemctl", args: ["is-enabled", "nftables"], timeout: 5000, toolName: "firewall" });
+                        const nftPersistent = nftConfExists.exitCode === 0 && nftSvcEnabled.stdout.trim() === "enabled";
+                        findings.push({
+                            check: "firewall_persistence",
+                            status: nftPersistent ? "PASS" : "WARN",
+                            value: nftPersistent ? "nftables persistence configured" : "nftables persistence not configured",
+                            description: "nftables rules persistence (/etc/nftables.conf + systemd service)",
+                            recommendation: nftPersistent
+                                ? undefined
+                                : "Ensure /etc/nftables.conf contains your rules and run: sudo systemctl enable nftables",
+                        });
+                    }
+                    else {
+                        const fwpPolicy = daPolicy.fwPersistence;
+                        const persistResult = await executeCommand({ command: fwpPolicy.checkInstalledCmd[0], args: fwpPolicy.checkInstalledCmd.slice(1), timeout: 5000, toolName: "firewall" });
+                        const persistInstalled = daPolicy.isDebian ? persistResult.stdout.includes("ii") : persistResult.exitCode === 0;
+                        findings.push({
+                            check: "firewall_persistence",
+                            status: persistInstalled ? "PASS" : "WARN",
+                            value: persistInstalled ? "installed" : "not installed",
+                            description: `${fwpPolicy.packageName} (rules survive reboot)`,
+                            recommendation: persistInstalled
+                                ? undefined
+                                : "Use firewall with action='persist_enable' to install and activate persistence, then action='persist_save' to persist current rules",
+                        });
+                    }
                     const passCount = findings.filter(f => f.status === "PASS").length;
                     const failCount = findings.filter(f => f.status === "FAIL").length;
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: passCount, fail: failCount, warn: findings.filter(f => f.status === "WARN").length }, findings }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: passCount, fail: failCount, warn: findings.filter(f => f.status === "WARN").length }, findings }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };

package/build/tools/hardening.js

@@ -13,8 +13,7 @@ import { validateServiceName, sanitizeArgs, validateSysctlKey, } from "../core/s
 import { SafeguardRegistry } from "../core/safeguards.js";
 import { SudoSession } from "../core/sudo-session.js";
 import { readFileSync, existsSync } from "node:fs";
-import { execSync } from "node:child_process";
-import { spawnSafe } from "../core/spawn-safe.js";
+import { spawnSafe, execFileSafe } from "../core/spawn-safe.js";
 import { secureWriteFileSync } from "../core/secure-fs.js";
 // ── TOOL-019 remediation: privilege check helper ───────────────────────────
 /**
@@ -38,7 +37,7 @@ function checkPrivileges() {
     }
     // Fallback: Check if sudo is available without password (NOPASSWD)
     try {
-        execSync("sudo -n true 2>/dev/null", { timeout: 3000, stdio: "ignore" });
+        execFileSafe("sudo", ["-n", "true"], { timeout: 3000, stdio: "ignore" });
         return { ok: true };
     }
     catch {
@@ -681,7 +680,7 @@ export function registerHardeningTools(server) {
                                     info: findings.length - passCount - failCount - warnCount,
                                 },
                                 findings,
-                            }, null, 2))],
+                            }))],
                     };
                 }
                 catch (error) {
@@ -717,7 +716,7 @@ export function registerHardeningTools(server) {
                         results.push({ module: mod.name, description: mod.description, cis: mod.cis, blacklisted, loaded, status: blacklisted && !loaded ? "PASS" : loaded ? "FAIL" : "WARN" });
                     }
                     const passCount = results.filter(r => r.status === "PASS").length;
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: results.length, pass: passCount, fail: results.filter(r => r.status === "FAIL").length, warn: results.filter(r => r.status === "WARN").length }, results }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: results.length, pass: passCount, fail: results.filter(r => r.status === "FAIL").length, warn: results.filter(r => r.status === "WARN").length }, results }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -913,7 +912,7 @@ export function registerHardeningTools(server) {
                                 },
                                 kernelCommandLine: cmd,
                                 findings,
-                            }, null, 2))],
+                            }))],
                     };
                 }
                 catch (error) {
@@ -1899,7 +1898,7 @@ export function registerHardeningTools(server) {
                                     totalFindings: findings.length,
                                     findings: findings.slice(0, 50),
                                     rawExposureLine: exposureLine || "Not found",
-                                }, null, 2))],
+                                }))],
                         };
                     }
                     else {
@@ -1937,7 +1936,7 @@ export function registerHardeningTools(server) {
                                     },
                                     flaggedServices: flagged,
                                     allServices: services,
-                                }, null, 2))],
+                                }))],
                         };
                     }
                 }
@@ -2120,7 +2119,7 @@ export function registerHardeningTools(server) {
                         }
                     }
                     const passCount = findings.filter(f => f.status === "PASS").length;
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: passCount, fail: findings.filter(f => f.status === "FAIL").length, warn: findings.filter(f => f.status === "WARN").length }, findings }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: passCount, fail: findings.filter(f => f.status === "FAIL").length, warn: findings.filter(f => f.status === "WARN").length }, findings }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -2148,7 +2147,7 @@ export function registerHardeningTools(server) {
                             findings.push({ check: `umask_${file.path.replace(/\//g, "_")}`, status: hasSecure ? "PASS" : "WARN", value: lines.join("; ").substring(0, 200) || "not explicitly set", description: `umask in ${file.path} (should be 027 or 077)` });
                         }
                     }
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: findings.filter(f => f.status === "PASS").length, warn: findings.filter(f => f.status === "WARN").length }, findings, recommendation: "Set umask 027 in /etc/profile and /etc/login.defs for CIS compliance" }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: findings.filter(f => f.status === "PASS").length, warn: findings.filter(f => f.status === "WARN").length }, findings, recommendation: "Set umask 027 in /etc/profile and /etc/login.defs for CIS compliance" }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -2278,7 +2277,7 @@ export function registerHardeningTools(server) {
                             findings.push({ check: `${banner.path.replace(/\//g, "_")}_perms`, status: perms.stdout.trim().startsWith("644") ? "PASS" : "WARN", value: perms.stdout.trim(), description: `${banner.description} permissions (should be 644 root:root)` });
                         }
                     }
-                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: findings.filter(f => f.status === "PASS").length, fail: findings.filter(f => f.status === "FAIL").length, warn: findings.filter(f => f.status === "WARN").length }, findings }, null, 2))] };
+                    return { content: [createTextContent(JSON.stringify({ summary: { total: findings.length, pass: findings.filter(f => f.status === "PASS").length, fail: findings.filter(f => f.status === "FAIL").length, warn: findings.filter(f => f.status === "WARN").length }, findings }))] };
                 }
                 catch (error) {
                     return { content: [createErrorContent(error instanceof Error ? error.message : String(error))], isError: true };
@@ -2433,7 +2432,7 @@ export function registerHardeningTools(server) {
                         }
                     }
                     if (findings.lsusbNote) {
-                        text += `\n⚠ ${findings.lsusbNote}\n`;
+                        text += `\nWARNING: ${findings.lsusbNote}\n`;
                     }
                     text += `\nUSB Storage Devices: ${findings.storageDeviceCount ?? 0}\n`;
                     if (Array.isArray(findings.storageDevices) && findings.storageDevices.length > 0) {
@@ -2507,7 +2506,7 @@ export function registerHardeningTools(server) {
                         for (const r of results) {
                             text += `  • ${r.target}: ${r.action} [${r.status}]\n`;
                         }
-                        text += `\nUSB Storage Module Still Loaded: ${moduleStillLoaded ? "yes ⚠" : "no ✓"}\n`;
+                        text += `\nUSB Storage Module Still Loaded: ${moduleStillLoaded ? "yes WARNING" : "no OK"}\n`;
                         return { content: [createTextContent(text)] };
                     }
                     else {

package/build/tools/incident-response.js

@@ -204,11 +204,11 @@ export function registerIncidentResponseTools(server) {
                                 timeout: 5000,
                             });
                             const size = sizeResult.stdout.trim();
-                            lines.push(`  ✓ ${step.name}: ${step.desc} (${size} bytes)`);
+                            lines.push(`  OK ${step.name}: ${step.desc} (${size} bytes)`);
                             successCount++;
                         }
                         else {
-                            lines.push(`  ✗ ${step.name}: ${step.desc} [FAILED: ${result.stderr.trim()}]`);
+                            lines.push(`  FAIL ${step.name}: ${step.desc} [FAILED: ${result.stderr.trim()}]`);
                             failCount++;
                         }
                     }
@@ -1124,7 +1124,7 @@ export function registerIncidentResponseTools(server) {
                                 `Evidence Path: ${evidence_path}`,
                                 `Current SHA-256: ${currentHash}`,
                                 `Recorded SHA-256: ${recordedHash ?? "NOT FOUND"}`,
-                                `Integrity: ${hashMatch ? "✓ VERIFIED — hashes match" : "✗ MISMATCH — evidence may be tampered"}`,
+                                `Integrity: ${hashMatch ? "OK VERIFIED — hashes match" : "FAIL MISMATCH — evidence may be tampered"}`,
                             ];
                             return { content: [createTextContent(lines.join("\n"))] };
                         }