dns-security-mcp 0.1.0

package/dist/report/index.js

@@ -0,0 +1,1167 @@
+import { z } from "zod";
+import { text, json } from "../types/index.js";
+import { resolveAll, createResolver, queryRaw } from "../utils/dns-client.js";
+// ─── Constants ───
+const FETCH_TIMEOUT = 10_000;
+// ─── Helpers ───
+function reverseIp(ip) {
+    return ip.split(".").reverse().join(".");
+}
+async function lookupDnsbl(query, dnsblDomain) {
+    const resolver = createResolver();
+    try {
+        const results = await resolver.resolve4(`${query}.${dnsblDomain}`);
+        return results.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function runCoreAuditChecks(domain) {
+    const findings = [];
+    const resolver = createResolver();
+    const scores = {};
+    // ── DNS Lookup ──
+    const allRecords = await resolveAll(domain, ["A", "AAAA", "NS", "MX", "TXT", "CAA", "SOA"]);
+    const aRecords = allRecords.filter((r) => r.type === "A").map((r) => r.data);
+    const aaaaRecords = allRecords.filter((r) => r.type === "AAAA").map((r) => r.data);
+    const nsRecords = allRecords.filter((r) => r.type === "NS").map((r) => r.data);
+    const mxRecords = allRecords.filter((r) => r.type === "MX").map((r) => r.data);
+    const txtRecords = allRecords.filter((r) => r.type === "TXT").map((r) => r.data);
+    const caaRecords = allRecords.filter((r) => r.type === "CAA").map((r) => r.data);
+    const soaRecord = allRecords.find((r) => r.type === "SOA")?.data ?? null;
+    const records = {
+        a: aRecords,
+        aaaa: aaaaRecords,
+        ns: nsRecords,
+        mx: mxRecords,
+        txt: txtRecords,
+        caa: caaRecords,
+        soa: soaRecord,
+    };
+    // ── DNS Resolution ──
+    scores.dns = { passed: 0, total: 2 };
+    if (aRecords.length > 0 || aaaaRecords.length > 0) {
+        scores.dns.passed++;
+    }
+    else {
+        findings.push({
+            severity: "critical",
+            title: "No A/AAAA records",
+            description: `Domain ${domain} does not resolve to any IP address.`,
+            remediation: "Ensure A and/or AAAA records are configured.",
+            category: "dns",
+        });
+    }
+    if (nsRecords.length > 0) {
+        scores.dns.passed++;
+    }
+    else {
+        findings.push({
+            severity: "high",
+            title: "No NS records",
+            description: `No nameserver records found for ${domain}.`,
+            remediation: "Configure NS records at the domain registrar.",
+            category: "dns",
+        });
+    }
+    // ── DNSSEC Presence ──
+    scores.dnssec = { passed: 0, total: 2 };
+    // Check for DS record (delegation signer)
+    let hasDsRecord = false;
+    try {
+        const dsResult = await queryRaw(domain, "DS", "8.8.8.8", 53, { rd: true, dnssec: true });
+        hasDsRecord = dsResult.answers.some((a) => a.type === "DS");
+    }
+    catch {
+        // DS query failed
+    }
+    if (hasDsRecord) {
+        scores.dnssec.passed++;
+    }
+    else {
+        findings.push({
+            severity: "high",
+            title: "No DNSSEC DS record",
+            description: `No DS (Delegation Signer) record found for ${domain}. DNSSEC is not enabled.`,
+            remediation: "Enable DNSSEC by publishing DS records at the parent zone/registrar.",
+            category: "dnssec",
+        });
+    }
+    // Check for DNSKEY record
+    let hasDnskeyRecord = false;
+    try {
+        const dnskeyResult = await queryRaw(domain, "DNSKEY", "8.8.8.8", 53, { rd: true, dnssec: true });
+        hasDnskeyRecord = dnskeyResult.answers.some((a) => a.type === "DNSKEY");
+    }
+    catch {
+        // DNSKEY query failed
+    }
+    if (hasDnskeyRecord) {
+        scores.dnssec.passed++;
+    }
+    else {
+        findings.push({
+            severity: "medium",
+            title: "No DNSKEY record",
+            description: `No DNSKEY record found for ${domain}.`,
+            remediation: "Configure DNSKEY records as part of DNSSEC deployment.",
+            category: "dnssec",
+        });
+    }
+    // ── Email Security (SPF, DMARC) ──
+    scores.email = { passed: 0, total: 3 };
+    // SPF
+    const spfRecords = txtRecords.filter((t) => t.startsWith("v=spf1"));
+    if (spfRecords.length === 1) {
+        scores.email.passed++;
+        // Check for overly permissive SPF
+        if (spfRecords[0].includes("+all")) {
+            findings.push({
+                severity: "high",
+                title: "SPF permits all senders (+all)",
+                description: `SPF record uses +all which allows any server to send email for ${domain}.`,
+                remediation: "Use -all (hard fail) or ~all (soft fail) instead of +all.",
+                category: "email",
+            });
+        }
+    }
+    else if (spfRecords.length > 1) {
+        findings.push({
+            severity: "medium",
+            title: "Multiple SPF records",
+            description: `Found ${spfRecords.length} SPF records. RFC 7208 requires exactly one SPF record.`,
+            remediation: "Consolidate into a single SPF TXT record.",
+            category: "email",
+        });
+    }
+    else {
+        findings.push({
+            severity: "high",
+            title: "No SPF record",
+            description: `No SPF TXT record found for ${domain}.`,
+            remediation: "Publish a v=spf1 TXT record to authorize mail senders.",
+            category: "email",
+        });
+    }
+    // DMARC
+    let hasDmarc = false;
+    try {
+        const dmarcTxt = await resolver.resolveTxt(`_dmarc.${domain}`);
+        const dmarcRecords = dmarcTxt.map((chunks) => chunks.join("")).filter((t) => t.startsWith("v=DMARC1"));
+        if (dmarcRecords.length > 0) {
+            hasDmarc = true;
+            scores.email.passed++;
+            // Check DMARC policy
+            const policy = dmarcRecords[0].match(/;\s*p=(\w+)/);
+            if (policy && policy[1] === "none") {
+                findings.push({
+                    severity: "medium",
+                    title: "DMARC policy set to none",
+                    description: `DMARC policy is p=none — monitoring only, no enforcement.`,
+                    remediation: "Progress to p=quarantine or p=reject after monitoring.",
+                    category: "email",
+                });
+            }
+        }
+    }
+    catch {
+        // No DMARC record
+    }
+    if (!hasDmarc) {
+        findings.push({
+            severity: "high",
+            title: "No DMARC record",
+            description: `No DMARC record found at _dmarc.${domain}.`,
+            remediation: "Publish a DMARC TXT record at _dmarc.${domain} (e.g., v=DMARC1; p=reject; rua=mailto:dmarc@${domain}).",
+            category: "email",
+        });
+    }
+    // DKIM (check common selectors)
+    let hasDkim = false;
+    const dkimSelectors = ["default", "google", "selector1", "selector2", "dkim", "k1", "s1", "s2"];
+    for (const sel of dkimSelectors) {
+        try {
+            const dkimTxt = await resolver.resolveTxt(`${sel}._domainkey.${domain}`);
+            if (dkimTxt.length > 0) {
+                hasDkim = true;
+                break;
+            }
+        }
+        catch {
+            // Selector not found
+        }
+    }
+    if (hasDkim) {
+        scores.email.passed++;
+    }
+    else {
+        findings.push({
+            severity: "medium",
+            title: "No DKIM records found",
+            description: `No DKIM records found for common selectors at ${domain}.`,
+            remediation: "Configure DKIM signing and publish corresponding DNS records.",
+            category: "email",
+        });
+    }
+    // ── NS Diversity ──
+    scores.ns_diversity = { passed: 0, total: 2 };
+    if (nsRecords.length >= 2) {
+        scores.ns_diversity.passed++;
+    }
+    else {
+        findings.push({
+            severity: "high",
+            title: "Insufficient NS diversity",
+            description: `Only ${nsRecords.length} nameserver(s) found. At least 2 are recommended.`,
+            remediation: "Add additional nameservers on different networks for redundancy.",
+            category: "infrastructure",
+        });
+    }
+    // Check NS on different /24 subnets
+    const nsSubnets = new Set();
+    for (const ns of nsRecords.slice(0, 10)) {
+        try {
+            const nsIps = await resolver.resolve4(ns);
+            for (const ip of nsIps) {
+                nsSubnets.add(ip.split(".").slice(0, 3).join("."));
+            }
+        }
+        catch {
+            // NS resolution failed
+        }
+    }
+    if (nsSubnets.size >= 2) {
+        scores.ns_diversity.passed++;
+    }
+    else if (nsRecords.length >= 2) {
+        findings.push({
+            severity: "medium",
+            title: "Nameservers on same subnet",
+            description: `All nameservers resolve to the same /24 subnet (${[...nsSubnets].join(", ")}). A network outage could affect all NS.`,
+            remediation: "Use nameservers on different /24 networks for resilience.",
+            category: "infrastructure",
+        });
+    }
+    // ── CAA Records ──
+    scores.caa = { passed: 0, total: 1 };
+    if (caaRecords.length > 0) {
+        scores.caa.passed++;
+    }
+    else {
+        findings.push({
+            severity: "medium",
+            title: "No CAA records",
+            description: `No CAA records found for ${domain}. Any CA can issue certificates.`,
+            remediation: "Publish CAA records to restrict which CAs can issue certificates for this domain.",
+            category: "ct",
+        });
+    }
+    // ── Blocklist Check (Spamhaus DBL) ──
+    scores.blocklist = { passed: 0, total: 1 };
+    const isBlocklisted = await lookupDnsbl(domain, "dbl.spamhaus.org");
+    if (!isBlocklisted) {
+        scores.blocklist.passed++;
+    }
+    else {
+        findings.push({
+            severity: "critical",
+            title: "Domain listed on Spamhaus DBL",
+            description: `${domain} is listed on the Spamhaus Domain Block List (DBL).`,
+            remediation: "Investigate the listing cause and request removal at https://www.spamhaus.org/dbl/removal/.",
+            category: "blocklist",
+        });
+    }
+    // ── Dangling CNAME check on common subdomains ──
+    scores.hijack = { passed: 0, total: 1 };
+    const danglingSubdomains = [];
+    const commonSubs = ["www", "mail", "ftp", "webmail", "blog", "shop", "dev", "staging"];
+    await Promise.all(commonSubs.map(async (sub) => {
+        const fqdn = `${sub}.${domain}`;
+        try {
+            const cnames = await resolver.resolveCname(fqdn);
+            if (cnames.length > 0) {
+                // Check if the CNAME target resolves
+                for (const cname of cnames) {
+                    try {
+                        await resolver.resolve4(cname);
+                    }
+                    catch {
+                        // CNAME target does not resolve — dangling
+                        danglingSubdomains.push(`${fqdn} -> ${cname}`);
+                    }
+                }
+            }
+        }
+        catch {
+            // No CNAME or doesn't exist
+        }
+    }));
+    if (danglingSubdomains.length === 0) {
+        scores.hijack.passed++;
+    }
+    else {
+        for (const dangling of danglingSubdomains) {
+            findings.push({
+                severity: "high",
+                title: "Dangling CNAME detected",
+                description: `${dangling} — CNAME target does not resolve. Vulnerable to subdomain takeover.`,
+                remediation: "Remove the dangling CNAME record or point it to a valid target.",
+                category: "hijack",
+            });
+        }
+    }
+    return { findings, records, scores };
+}
+// ─── Tool 1: report_rfc_compliance ───
+const reportRfcCompliance = {
+    name: "report_rfc_compliance",
+    description: "Tests domain DNS compliance with key RFCs: RFC 1035 (valid labels, length), RFC 4034 (DNSSEC — DS/DNSKEY), " +
+        "RFC 6891 (EDNS — NS responds to EDNS), RFC 7208 (SPF — TXT has SPF), RFC 7489 (DMARC — _dmarc TXT). " +
+        "Returns per-RFC pass/fail status.",
+    schema: {
+        domain: z.string().describe("The domain to test for RFC compliance (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const rfcResults = [];
+            const resolver = createResolver();
+            // ── RFC 1035: Basic DNS Compliance ──
+            // Check label validity
+            const labels = domain.split(".");
+            let rfc1035Pass = true;
+            const rfc1035Details = [];
+            // Total domain length <= 253
+            if (domain.length > 253) {
+                rfc1035Pass = false;
+                rfc1035Details.push(`Domain length ${domain.length} exceeds 253 character limit`);
+            }
+            // Each label <= 63 characters, valid characters
+            for (const label of labels) {
+                if (label.length > 63) {
+                    rfc1035Pass = false;
+                    rfc1035Details.push(`Label "${label}" exceeds 63 character limit (${label.length})`);
+                }
+                if (!/^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/.test(label)) {
+                    rfc1035Pass = false;
+                    rfc1035Details.push(`Label "${label}" contains invalid characters`);
+                }
+            }
+            rfcResults.push({
+                rfc: "RFC 1035",
+                title: "Domain Names — Implementation and Specification",
+                status: rfc1035Pass ? "pass" : "fail",
+                detail: rfc1035Pass
+                    ? "All labels valid, length within limits."
+                    : rfc1035Details.join("; "),
+            });
+            // ── RFC 4034: DNSSEC ──
+            let hasDsOrDnskey = false;
+            const rfc4034Details = [];
+            try {
+                const dsResult = await queryRaw(domain, "DS", "8.8.8.8", 53, { rd: true, dnssec: true });
+                const dsFound = dsResult.answers.some((a) => a.type === "DS");
+                if (dsFound) {
+                    hasDsOrDnskey = true;
+                    rfc4034Details.push("DS record found");
+                }
+            }
+            catch {
+                rfc4034Details.push("DS query failed");
+            }
+            try {
+                const dnskeyResult = await queryRaw(domain, "DNSKEY", "8.8.8.8", 53, { rd: true, dnssec: true });
+                const dnskeyFound = dnskeyResult.answers.some((a) => a.type === "DNSKEY");
+                if (dnskeyFound) {
+                    hasDsOrDnskey = true;
+                    rfc4034Details.push("DNSKEY record found");
+                }
+            }
+            catch {
+                rfc4034Details.push("DNSKEY query failed");
+            }
+            rfcResults.push({
+                rfc: "RFC 4034",
+                title: "Resource Records for DNS Security Extensions (DNSSEC)",
+                status: hasDsOrDnskey ? "pass" : "fail",
+                detail: hasDsOrDnskey
+                    ? rfc4034Details.join("; ")
+                    : "No DS or DNSKEY records found — DNSSEC not enabled.",
+            });
+            // ── RFC 6891: EDNS ──
+            let ednsSupported = false;
+            let rfc6891Detail = "";
+            try {
+                // Query with EDNS OPT record
+                const ednsResult = await queryRaw(domain, "A", "8.8.8.8", 53, { rd: true, dnssec: true });
+                // Check for OPT in additionals
+                const hasOpt = ednsResult.additionals.some((a) => a.type === "OPT");
+                if (hasOpt) {
+                    ednsSupported = true;
+                    rfc6891Detail = "Resolver responds with EDNS OPT record.";
+                }
+                else {
+                    // Even without OPT in response, if we get answers, EDNS is at least tolerated
+                    if (ednsResult.answers.length > 0) {
+                        ednsSupported = true;
+                        rfc6891Detail = "Server processes EDNS queries (no OPT in response but query succeeded).";
+                    }
+                    else {
+                        rfc6891Detail = "No EDNS support detected.";
+                    }
+                }
+            }
+            catch {
+                rfc6891Detail = "EDNS query failed — server may not support extension mechanisms.";
+            }
+            rfcResults.push({
+                rfc: "RFC 6891",
+                title: "Extension Mechanisms for DNS (EDNS(0))",
+                status: ednsSupported ? "pass" : "warn",
+                detail: rfc6891Detail,
+            });
+            // ── RFC 7208: SPF ──
+            let hasSpf = false;
+            let rfc7208Detail = "";
+            try {
+                const txtResults = await resolver.resolveTxt(domain);
+                const spfRecords = txtResults
+                    .map((chunks) => chunks.join(""))
+                    .filter((t) => t.startsWith("v=spf1"));
+                if (spfRecords.length === 1) {
+                    hasSpf = true;
+                    rfc7208Detail = `SPF record found: ${spfRecords[0].substring(0, 100)}`;
+                }
+                else if (spfRecords.length > 1) {
+                    rfc7208Detail = `${spfRecords.length} SPF records found — RFC 7208 requires exactly one.`;
+                }
+                else {
+                    rfc7208Detail = "No SPF record found.";
+                }
+            }
+            catch {
+                rfc7208Detail = "Failed to resolve TXT records.";
+            }
+            rfcResults.push({
+                rfc: "RFC 7208",
+                title: "Sender Policy Framework (SPF)",
+                status: hasSpf ? "pass" : "fail",
+                detail: rfc7208Detail,
+            });
+            // ── RFC 7489: DMARC ──
+            let hasDmarc = false;
+            let rfc7489Detail = "";
+            try {
+                const dmarcTxt = await resolver.resolveTxt(`_dmarc.${domain}`);
+                const dmarcRecords = dmarcTxt
+                    .map((chunks) => chunks.join(""))
+                    .filter((t) => t.startsWith("v=DMARC1"));
+                if (dmarcRecords.length > 0) {
+                    hasDmarc = true;
+                    rfc7489Detail = `DMARC record found: ${dmarcRecords[0].substring(0, 100)}`;
+                }
+                else {
+                    rfc7489Detail = "No DMARC record found at _dmarc." + domain;
+                }
+            }
+            catch {
+                rfc7489Detail = "No DMARC record found at _dmarc." + domain;
+            }
+            rfcResults.push({
+                rfc: "RFC 7489",
+                title: "Domain-based Message Authentication, Reporting and Conformance (DMARC)",
+                status: hasDmarc ? "pass" : "fail",
+                detail: rfc7489Detail,
+            });
+            // Summary
+            const passed = rfcResults.filter((r) => r.status === "pass").length;
+            const failed = rfcResults.filter((r) => r.status === "fail").length;
+            const warned = rfcResults.filter((r) => r.status === "warn").length;
+            return json({
+                domain,
+                total_checks: rfcResults.length,
+                passed,
+                failed,
+                warnings: warned,
+                compliance_score: Math.round((passed / rfcResults.length) * 100),
+                rfc_results: rfcResults,
+            });
+        }
+        catch (err) {
+            return text(`Error checking RFC compliance for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 2: report_best_practice ───
+const reportBestPractice = {
+    name: "report_best_practice",
+    description: "CIS DNS Benchmark-style best practice checks: DNSSEC signed, email auth (SPF+DKIM+DMARC), " +
+        "NS diversity (>1 NS, different /24), zone transfer restricted, version.bind hidden, recursive disabled on authoritative. " +
+        "Returns pass/fail per check and overall score 0-100.",
+    schema: {
+        domain: z.string().describe("The domain to run best practice checks against (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const checks = [];
+            const resolver = createResolver();
+            const allRecords = await resolveAll(domain, ["A", "NS", "MX", "TXT", "CAA"]);
+            const nsRecords = allRecords.filter((r) => r.type === "NS").map((r) => r.data);
+            const txtRecords = allRecords.filter((r) => r.type === "TXT").map((r) => r.data);
+            const caaRecords = allRecords.filter((r) => r.type === "CAA").map((r) => r.data);
+            // ── Check 1: DNSSEC ──
+            let dnssecSigned = false;
+            try {
+                const dsResult = await queryRaw(domain, "DS", "8.8.8.8", 53, { rd: true, dnssec: true });
+                dnssecSigned = dsResult.answers.some((a) => a.type === "DS");
+            }
+            catch {
+                // DS query failed
+            }
+            checks.push({
+                check: "DNSSEC Signed",
+                category: "security",
+                status: dnssecSigned ? "pass" : "fail",
+                detail: dnssecSigned ? "DS record found — zone is DNSSEC signed." : "No DS record — DNSSEC not enabled.",
+                weight: 20,
+            });
+            // ── Check 2: SPF ──
+            const spfRecords = txtRecords.filter((t) => t.startsWith("v=spf1"));
+            const hasValidSpf = spfRecords.length === 1;
+            checks.push({
+                check: "SPF Record",
+                category: "email",
+                status: hasValidSpf ? "pass" : "fail",
+                detail: hasValidSpf
+                    ? `Valid SPF: ${spfRecords[0].substring(0, 80)}`
+                    : spfRecords.length > 1
+                        ? `Multiple SPF records found (${spfRecords.length}) — invalid`
+                        : "No SPF record found.",
+                weight: 15,
+            });
+            // ── Check 3: DKIM ──
+            let hasDkim = false;
+            const dkimSelectors = ["default", "google", "selector1", "selector2", "dkim", "k1", "s1"];
+            for (const sel of dkimSelectors) {
+                try {
+                    const dkimTxt = await resolver.resolveTxt(`${sel}._domainkey.${domain}`);
+                    if (dkimTxt.length > 0) {
+                        hasDkim = true;
+                        break;
+                    }
+                }
+                catch {
+                    // Selector not found
+                }
+            }
+            checks.push({
+                check: "DKIM Record",
+                category: "email",
+                status: hasDkim ? "pass" : "warn",
+                detail: hasDkim
+                    ? "DKIM record found for at least one common selector."
+                    : "No DKIM records found for common selectors.",
+                weight: 10,
+            });
+            // ── Check 4: DMARC ──
+            let hasDmarc = false;
+            let dmarcPolicy = "";
+            try {
+                const dmarcTxt = await resolver.resolveTxt(`_dmarc.${domain}`);
+                const dmarcRecords = dmarcTxt.map((c) => c.join("")).filter((t) => t.startsWith("v=DMARC1"));
+                if (dmarcRecords.length > 0) {
+                    hasDmarc = true;
+                    const policyMatch = dmarcRecords[0].match(/;\s*p=(\w+)/);
+                    dmarcPolicy = policyMatch ? policyMatch[1] : "none";
+                }
+            }
+            catch {
+                // No DMARC
+            }
+            checks.push({
+                check: "DMARC Record",
+                category: "email",
+                status: hasDmarc
+                    ? dmarcPolicy === "reject" || dmarcPolicy === "quarantine"
+                        ? "pass"
+                        : "warn"
+                    : "fail",
+                detail: hasDmarc
+                    ? `DMARC found with p=${dmarcPolicy}`
+                    : "No DMARC record found.",
+                weight: 15,
+            });
+            // ── Check 5: NS Diversity (>1 NS) ──
+            checks.push({
+                check: "NS Count (>1)",
+                category: "infrastructure",
+                status: nsRecords.length >= 2 ? "pass" : "fail",
+                detail: `${nsRecords.length} nameserver(s) found.`,
+                weight: 10,
+            });
+            // ── Check 6: NS on different /24 subnets ──
+            const nsSubnets = new Set();
+            for (const ns of nsRecords.slice(0, 10)) {
+                try {
+                    const nsIps = await resolver.resolve4(ns);
+                    for (const ip of nsIps) {
+                        nsSubnets.add(ip.split(".").slice(0, 3).join("."));
+                    }
+                }
+                catch {
+                    // NS resolution failed
+                }
+            }
+            checks.push({
+                check: "NS Network Diversity",
+                category: "infrastructure",
+                status: nsSubnets.size >= 2 ? "pass" : nsRecords.length >= 2 ? "warn" : "fail",
+                detail: nsSubnets.size >= 2
+                    ? `Nameservers span ${nsSubnets.size} different /24 subnets.`
+                    : `All nameservers on ${nsSubnets.size} /24 subnet(s).`,
+                weight: 10,
+            });
+            // ── Check 7: Zone Transfer Restricted (AXFR) ──
+            let zoneTransferOpen = false;
+            for (const ns of nsRecords.slice(0, 3)) {
+                try {
+                    const nsIps = await resolver.resolve4(ns);
+                    if (nsIps.length > 0) {
+                        // Try to import queryTcp for AXFR test
+                        try {
+                            const { queryTcp } = await import("../utils/dns-client.js");
+                            const axfrResult = await queryTcp(domain, "AXFR", nsIps[0]);
+                            if (axfrResult.length > 5) {
+                                zoneTransferOpen = true;
+                            }
+                        }
+                        catch {
+                            // AXFR denied or timeout — good
+                        }
+                    }
+                }
+                catch {
+                    // NS resolution failed
+                }
+            }
+            checks.push({
+                check: "Zone Transfer Restricted",
+                category: "security",
+                status: zoneTransferOpen ? "fail" : "pass",
+                detail: zoneTransferOpen
+                    ? "AXFR zone transfer is OPEN — anyone can download the full zone."
+                    : "Zone transfer appears restricted (AXFR denied or failed).",
+                weight: 10,
+            });
+            // ── Check 8: version.bind Hidden ──
+            let versionExposed = false;
+            let versionValue = "";
+            if (nsRecords.length > 0) {
+                try {
+                    const nsIps = await resolver.resolve4(nsRecords[0]);
+                    if (nsIps.length > 0) {
+                        const vResult = await queryRaw("version.bind", "TXT", nsIps[0], 53, { rd: false });
+                        const txtAnswers = vResult.answers.filter((a) => a.type === "TXT");
+                        if (txtAnswers.length > 0) {
+                            versionExposed = true;
+                            const txtData = txtAnswers[0].data;
+                            if (typeof txtData === "string") {
+                                versionValue = txtData;
+                            }
+                            else if (Buffer.isBuffer(txtData)) {
+                                versionValue = txtData.toString();
+                            }
+                            else if (Array.isArray(txtData)) {
+                                versionValue = txtData.map((d) => (Buffer.isBuffer(d) ? d.toString() : String(d))).join("");
+                            }
+                        }
+                    }
+                }
+                catch {
+                    // version.bind query failed — likely hidden (good)
+                }
+            }
+            checks.push({
+                check: "version.bind Hidden",
+                category: "security",
+                status: versionExposed ? "warn" : "pass",
+                detail: versionExposed
+                    ? `version.bind exposed: "${versionValue}" — reveals DNS software version.`
+                    : "version.bind not exposed or query denied.",
+                weight: 5,
+            });
+            // ── Check 9: CAA Records ──
+            checks.push({
+                check: "CAA Records Present",
+                category: "security",
+                status: caaRecords.length > 0 ? "pass" : "warn",
+                detail: caaRecords.length > 0
+                    ? `${caaRecords.length} CAA record(s) found — certificate issuance restricted.`
+                    : "No CAA records — any CA can issue certificates.",
+                weight: 5,
+            });
+            // ── Calculate Overall Score ──
+            let totalWeight = 0;
+            let earnedWeight = 0;
+            for (const check of checks) {
+                totalWeight += check.weight;
+                if (check.status === "pass") {
+                    earnedWeight += check.weight;
+                }
+                else if (check.status === "warn") {
+                    earnedWeight += check.weight * 0.5;
+                }
+            }
+            const overallScore = totalWeight > 0 ? Math.round((earnedWeight / totalWeight) * 100) : 0;
+            return json({
+                domain,
+                overall_score: overallScore,
+                grade: overallScore >= 90
+                    ? "A"
+                    : overallScore >= 80
+                        ? "B"
+                        : overallScore >= 70
+                            ? "C"
+                            : overallScore >= 60
+                                ? "D"
+                                : "F",
+                total_checks: checks.length,
+                passed: checks.filter((c) => c.status === "pass").length,
+                warnings: checks.filter((c) => c.status === "warn").length,
+                failed: checks.filter((c) => c.status === "fail").length,
+                checks,
+            });
+        }
+        catch (err) {
+            return text(`Error running best practice checks for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 3: report_full_audit ───
+const reportFullAudit = {
+    name: "report_full_audit",
+    description: "Runs a comprehensive DNS security audit across all categories: DNS resolution, DNSSEC validation, " +
+        "email security (SPF/DKIM/DMARC), subdomain hijack (dangling CNAME/NS), Certificate Transparency, " +
+        "blocklist checks, and infrastructure analysis. Returns executive summary and per-category findings.",
+    schema: {
+        domain: z.string().describe("The domain to perform a full security audit on (e.g. 'example.com')"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        try {
+            const { findings, records, scores } = await runCoreAuditChecks(domain);
+            // ── Executive Summary ──
+            const critical = findings.filter((f) => f.severity === "critical");
+            const high = findings.filter((f) => f.severity === "high");
+            const medium = findings.filter((f) => f.severity === "medium");
+            const low = findings.filter((f) => f.severity === "low");
+            const info = findings.filter((f) => f.severity === "info");
+            // Calculate overall score
+            let totalChecks = 0;
+            let passedChecks = 0;
+            for (const [, score] of Object.entries(scores)) {
+                totalChecks += score.total;
+                passedChecks += score.passed;
+            }
+            const overallScore = totalChecks > 0 ? Math.round((passedChecks / totalChecks) * 100) : 0;
+            // Group findings by category
+            const categories = new Map();
+            for (const finding of findings) {
+                const group = categories.get(finding.category) ?? [];
+                group.push(finding);
+                categories.set(finding.category, group);
+            }
+            const categoryResults = Array.from(categories.entries()).map(([category, catFindings]) => ({
+                category,
+                finding_count: catFindings.length,
+                worst_severity: catFindings.reduce((worst, f) => {
+                    const order = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+                    return order[f.severity] < order[worst] ? f.severity : worst;
+                }, "info"),
+                findings: catFindings,
+            }));
+            const categoryScores = Object.fromEntries(Object.entries(scores).map(([k, v]) => [
+                k,
+                { passed: v.passed, total: v.total, score: v.total > 0 ? Math.round((v.passed / v.total) * 100) : 100 },
+            ]));
+            return json({
+                domain,
+                audit_timestamp: new Date().toISOString(),
+                executive_summary: {
+                    overall_score: overallScore,
+                    grade: overallScore >= 90
+                        ? "A"
+                        : overallScore >= 80
+                            ? "B"
+                            : overallScore >= 70
+                                ? "C"
+                                : overallScore >= 60
+                                    ? "D"
+                                    : "F",
+                    total_findings: findings.length,
+                    by_severity: {
+                        critical: critical.length,
+                        high: high.length,
+                        medium: medium.length,
+                        low: low.length,
+                        info: info.length,
+                    },
+                    top_risks: critical.concat(high).slice(0, 5).map((f) => ({
+                        severity: f.severity,
+                        title: f.title,
+                        category: f.category,
+                    })),
+                },
+                dns_records: records,
+                category_scores: categoryScores,
+                category_results: categoryResults,
+                all_findings: findings,
+            });
+        }
+        catch (err) {
+            return text(`Error running full audit for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 4: report_generate ───
+const reportGenerate = {
+    name: "report_generate",
+    description: "Runs a full DNS security audit and outputs in the specified format: json (raw findings), " +
+        "markdown (formatted report with severity headers), or sarif (SARIF 2.1.0 structure for integration " +
+        "with code analysis tools). Default format is json.",
+    schema: {
+        domain: z.string().describe("The domain to generate a security report for (e.g. 'example.com')"),
+        format: z
+            .enum(["json", "markdown", "sarif"])
+            .optional()
+            .describe("Output format: 'json' (raw), 'markdown' (formatted report), or 'sarif' (SARIF 2.1.0). Default 'json'."),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const format = args.format ?? "json";
+        try {
+            const { findings, records, scores } = await runCoreAuditChecks(domain);
+            // Calculate overall score
+            let totalChecks = 0;
+            let passedChecks = 0;
+            for (const [, score] of Object.entries(scores)) {
+                totalChecks += score.total;
+                passedChecks += score.passed;
+            }
+            const overallScore = totalChecks > 0 ? Math.round((passedChecks / totalChecks) * 100) : 0;
+            if (format === "markdown") {
+                // ── Markdown Format ──
+                const lines = [];
+                lines.push(`# DNS Security Audit Report: ${domain}`);
+                lines.push("");
+                lines.push(`**Date:** ${new Date().toISOString()}`);
+                lines.push(`**Overall Score:** ${overallScore}/100`);
+                lines.push("");
+                // Summary
+                const critical = findings.filter((f) => f.severity === "critical");
+                const high = findings.filter((f) => f.severity === "high");
+                const medium = findings.filter((f) => f.severity === "medium");
+                const low = findings.filter((f) => f.severity === "low");
+                lines.push("## Executive Summary");
+                lines.push("");
+                lines.push(`| Severity | Count |`);
+                lines.push(`|----------|-------|`);
+                lines.push(`| Critical | ${critical.length} |`);
+                lines.push(`| High     | ${high.length} |`);
+                lines.push(`| Medium   | ${medium.length} |`);
+                lines.push(`| Low      | ${low.length} |`);
+                lines.push("");
+                // DNS Records
+                lines.push("## DNS Records");
+                lines.push("");
+                lines.push(`- **A:** ${records.a.join(", ") || "none"}`);
+                lines.push(`- **AAAA:** ${records.aaaa.join(", ") || "none"}`);
+                lines.push(`- **NS:** ${records.ns.join(", ") || "none"}`);
+                lines.push(`- **MX:** ${records.mx.join(", ") || "none"}`);
+                lines.push(`- **CAA:** ${records.caa.join(", ") || "none"}`);
+                lines.push("");
+                // Findings by severity
+                if (critical.length > 0) {
+                    lines.push("## Critical Findings");
+                    lines.push("");
+                    for (const f of critical) {
+                        lines.push(`### ${f.title}`);
+                        lines.push(`- **Category:** ${f.category}`);
+                        lines.push(`- **Description:** ${f.description}`);
+                        if (f.remediation)
+                            lines.push(`- **Remediation:** ${f.remediation}`);
+                        lines.push("");
+                    }
+                }
+                if (high.length > 0) {
+                    lines.push("## High Findings");
+                    lines.push("");
+                    for (const f of high) {
+                        lines.push(`### ${f.title}`);
+                        lines.push(`- **Category:** ${f.category}`);
+                        lines.push(`- **Description:** ${f.description}`);
+                        if (f.remediation)
+                            lines.push(`- **Remediation:** ${f.remediation}`);
+                        lines.push("");
+                    }
+                }
+                if (medium.length > 0) {
+                    lines.push("## Medium Findings");
+                    lines.push("");
+                    for (const f of medium) {
+                        lines.push(`### ${f.title}`);
+                        lines.push(`- **Category:** ${f.category}`);
+                        lines.push(`- **Description:** ${f.description}`);
+                        if (f.remediation)
+                            lines.push(`- **Remediation:** ${f.remediation}`);
+                        lines.push("");
+                    }
+                }
+                if (low.length > 0) {
+                    lines.push("## Low Findings");
+                    lines.push("");
+                    for (const f of low) {
+                        lines.push(`### ${f.title}`);
+                        lines.push(`- **Category:** ${f.category}`);
+                        lines.push(`- **Description:** ${f.description}`);
+                        if (f.remediation)
+                            lines.push(`- **Remediation:** ${f.remediation}`);
+                        lines.push("");
+                    }
+                }
+                // Category Scores
+                lines.push("## Category Scores");
+                lines.push("");
+                lines.push(`| Category | Score |`);
+                lines.push(`|----------|-------|`);
+                for (const [cat, score] of Object.entries(scores)) {
+                    const pct = score.total > 0 ? Math.round((score.passed / score.total) * 100) : 100;
+                    lines.push(`| ${cat} | ${pct}% (${score.passed}/${score.total}) |`);
+                }
+                lines.push("");
+                return text(lines.join("\n"));
+            }
+            if (format === "sarif") {
+                // ── SARIF 2.1.0 Format ──
+                const severityToLevel = {
+                    critical: "error",
+                    high: "error",
+                    medium: "warning",
+                    low: "note",
+                    info: "note",
+                };
+                const rules = findings.map((f, i) => ({
+                    id: `dns-${f.category}-${i}`,
+                    name: f.title.replace(/[^a-zA-Z0-9]/g, ""),
+                    shortDescription: { text: f.title },
+                    fullDescription: { text: f.description },
+                    help: { text: f.remediation ?? "No remediation provided." },
+                    defaultConfiguration: {
+                        level: severityToLevel[f.severity] ?? "note",
+                    },
+                    properties: {
+                        severity: f.severity,
+                        category: f.category,
+                    },
+                }));
+                const results = findings.map((f, i) => ({
+                    ruleId: `dns-${f.category}-${i}`,
+                    level: severityToLevel[f.severity] ?? "note",
+                    message: { text: f.description },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: domain },
+                            },
+                        },
+                    ],
+                    properties: {
+                        severity: f.severity,
+                        category: f.category,
+                        remediation: f.remediation ?? undefined,
+                    },
+                }));
+                const sarif = {
+                    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+                    version: "2.1.0",
+                    runs: [
+                        {
+                            tool: {
+                                driver: {
+                                    name: "dns-security-mcp",
+                                    version: "0.1.0",
+                                    informationUri: "https://github.com/dns-security-mcp",
+                                    rules,
+                                },
+                            },
+                            results,
+                            invocations: [
+                                {
+                                    executionSuccessful: true,
+                                    endTimeUtc: new Date().toISOString(),
+                                    properties: {
+                                        domain,
+                                        overallScore,
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                };
+                return json(sarif);
+            }
+            // ── Default JSON Format ──
+            return json({
+                domain,
+                format: "json",
+                audit_timestamp: new Date().toISOString(),
+                overall_score: overallScore,
+                dns_records: records,
+                category_scores: Object.fromEntries(Object.entries(scores).map(([k, v]) => [
+                    k,
+                    { passed: v.passed, total: v.total, score: v.total > 0 ? Math.round((v.passed / v.total) * 100) : 100 },
+                ])),
+                findings,
+            });
+        }
+        catch (err) {
+            return text(`Error generating report for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Tool 5: report_compare ───
+const reportCompare = {
+    name: "report_compare",
+    description: "Runs a current DNS security audit and compares it against a baseline (JSON string from a previous run). " +
+        "Returns new findings, resolved findings, and unchanged findings. Useful for tracking DNS security posture over time.",
+    schema: {
+        domain: z.string().describe("The domain to audit and compare against baseline (e.g. 'example.com')"),
+        baseline: z.string().describe("JSON string from a previous audit run (the 'findings' array from report_full_audit or report_generate output)"),
+    },
+    async execute(args) {
+        const domain = args.domain;
+        const baselineStr = args.baseline;
+        try {
+            // Parse baseline
+            let baselineFindings;
+            try {
+                const parsed = JSON.parse(baselineStr);
+                // Support both raw findings array and wrapped audit output
+                if (Array.isArray(parsed)) {
+                    baselineFindings = parsed;
+                }
+                else if (parsed.findings && Array.isArray(parsed.findings)) {
+                    baselineFindings = parsed.findings;
+                }
+                else if (parsed.all_findings && Array.isArray(parsed.all_findings)) {
+                    baselineFindings = parsed.all_findings;
+                }
+                else {
+                    return text("Error: Baseline JSON must be an array of findings or an object with 'findings' or 'all_findings' key.");
+                }
+            }
+            catch {
+                return text("Error: Invalid baseline JSON string. Provide the JSON output from a previous audit run.");
+            }
+            // Run current audit
+            const { findings: currentFindings, records, scores } = await runCoreAuditChecks(domain);
+            // Create fingerprints for comparison (title + category is unique enough)
+            const fingerprint = (f) => `${f.category}::${f.title}`;
+            const baselineSet = new Set(baselineFindings.map(fingerprint));
+            const currentSet = new Set(currentFindings.map(fingerprint));
+            // Categorize
+            const newFindings = [];
+            const resolvedFindings = [];
+            const unchangedFindings = [];
+            for (const f of currentFindings) {
+                const fp = fingerprint(f);
+                if (baselineSet.has(fp)) {
+                    unchangedFindings.push(f);
+                }
+                else {
+                    newFindings.push(f);
+                }
+            }
+            for (const f of baselineFindings) {
+                const fp = fingerprint(f);
+                if (!currentSet.has(fp)) {
+                    resolvedFindings.push(f);
+                }
+            }
+            // Calculate scores
+            let totalChecks = 0;
+            let passedChecks = 0;
+            for (const [, score] of Object.entries(scores)) {
+                totalChecks += score.total;
+                passedChecks += score.passed;
+            }
+            const currentScore = totalChecks > 0 ? Math.round((passedChecks / totalChecks) * 100) : 0;
+            // Determine trend
+            let trend;
+            if (newFindings.length === 0 && resolvedFindings.length > 0) {
+                trend = "improved";
+            }
+            else if (newFindings.length > 0 && resolvedFindings.length === 0) {
+                trend = "degraded";
+            }
+            else if (newFindings.length > resolvedFindings.length) {
+                trend = "degraded";
+            }
+            else if (resolvedFindings.length > newFindings.length) {
+                trend = "improved";
+            }
+            else {
+                trend = "unchanged";
+            }
+            return json({
+                domain,
+                comparison_timestamp: new Date().toISOString(),
+                current_score: currentScore,
+                trend,
+                summary: {
+                    baseline_findings: baselineFindings.length,
+                    current_findings: currentFindings.length,
+                    new_findings: newFindings.length,
+                    resolved_findings: resolvedFindings.length,
+                    unchanged_findings: unchangedFindings.length,
+                },
+                new_findings: newFindings.map((f) => ({
+                    severity: f.severity,
+                    title: f.title,
+                    description: f.description,
+                    category: f.category,
+                    remediation: f.remediation,
+                    status: "NEW",
+                })),
+                resolved_findings: resolvedFindings.map((f) => ({
+                    severity: f.severity,
+                    title: f.title,
+                    description: f.description,
+                    category: f.category,
+                    status: "RESOLVED",
+                })),
+                unchanged_findings: unchangedFindings.map((f) => ({
+                    severity: f.severity,
+                    title: f.title,
+                    category: f.category,
+                    status: "UNCHANGED",
+                })),
+                current_dns_records: records,
+            });
+        }
+        catch (err) {
+            return text(`Error comparing audit for ${domain}: ${err.message}`);
+        }
+    },
+};
+// ─── Export All Report Tools ───
+export const reportTools = [
+    reportRfcCompliance,
+    reportBestPractice,
+    reportFullAudit,
+    reportGenerate,
+    reportCompare,
+];
+//# sourceMappingURL=index.js.map