framework-mcp 1.0.0 → 1.1.0

package/.claude/config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/.claude_config.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/.github/workflows/release.yml

@@ -0,0 +1,30 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://registry.npmjs.org'
+    
+    - name: Install dependencies
+      run: npm ci
+    
+    - name: Build
+      run: npm run build
+    
+    - name: Publish to npm
+      run: npm publish
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sequential-thinking": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-sequential-thinking"
+      ]
+    }
+  }
+}

package/CIS_CONTROLS_IMPLEMENTATION_PLAN.md

@@ -0,0 +1,220 @@
+# CIS Controls v8.1 Implementation Plan
+
+## Current Status
+- **Completed**: 59 safeguards implemented (Controls 1-7 complete)
+- **Remaining**: Controls 8-18 (11 controls, estimated 40+ additional safeguards)
+- **Available Resources**: Individual PDF documents for each control in docs/ folder
+
+## Implementation Strategy
+
+### Sequential Processing Order
+Process controls in this specific order for optimal dependency management:
+
+#### Phase 1: Technical Infrastructure Controls (High Priority)
+1. **Control 8: Audit Log Management** 
+   - Foundation for security monitoring and detection
+   - PDF: `CISv8.1-Control 8.pdf`
+   - Estimated safeguards: 6-8
+
+2. **Control 10: Malware Defenses**
+   - Critical protection control 
+   - PDF: `CISv8.1-Control 10.pdf`
+   - Estimated safeguards: 6-8
+
+3. **Control 12: Network Infrastructure Management**
+   - Network security foundation
+   - PDF: `CISv8.1-Control 12.pdf`
+   - Estimated safeguards: 6-8
+
+4. **Control 13: Network Monitoring and Defense**
+   - Builds on Control 12, detection capabilities
+   - PDF: `CISv8.1-Control 13.pdf`
+   - Estimated safeguards: 6-8
+
+#### Phase 2: Data and Application Controls (Medium-High Priority)
+5. **Control 9: Email and Web Browser Protections**
+   - Common attack vectors
+   - PDF: `CISv8.1-Control 9.pdf`
+   - Estimated safeguards: 4-6
+
+6. **Control 11: Data Recovery**
+   - Business continuity foundation
+   - PDF: `CISv8.1-Control 11.pdf`
+   - Estimated safeguards: 3-5
+
+7. **Control 16: Application Software Security**
+   - Application layer security
+   - PDF: `CISv8.1-Control 16.pdf`
+   - Estimated safeguards: 6-8
+
+#### Phase 3: Process and Governance Controls (Medium Priority)
+8. **Control 14: Security Awareness and Skills Training**
+   - Human element, process-focused
+   - PDF: `CISv8.1-Control 14.pdf`
+   - Estimated safeguards: 4-6
+
+9. **Control 15: Service Provider Management**
+   - Third-party risk management
+   - PDF: `CISv8.1-Control 15.pdf`
+   - Estimated safeguards: 4-6
+
+10. **Control 17: Incident Response Management**
+    - Response processes and capabilities
+    - PDF: `CISv8.1-Control 17.pdf`
+    - Estimated safeguards: 6-8
+
+11. **Control 18: Penetration Testing**
+    - Validation and testing processes
+    - PDF: `CISv8.1-Control 18.pdf`
+    - Estimated safeguards: 3-5
+
+## Standard Session Template
+
+For each control, follow this systematic approach:
+
+### 1. Initialize Session
+```bash
+# Update todo list with current control
+# Example: "Process Control 8: Audit Log Management"
+```
+
+### 2. Read and Analyze PDF
+- Read the complete control PDF document
+- Identify all safeguards in the control (e.g., 8.1, 8.2, 8.3, etc.)
+- Note control title, description, and overall purpose
+- Extract Implementation Group classifications
+
+### 3. Extract Safeguard Elements
+For each safeguard, categorize elements using the color-coding system:
+
+- **🟠 Orange (Governance Elements)**: Process/policy requirements that MUST be met
+- **🟢 Green (Core Requirements)**: The essential "what" of the safeguard  
+- **🟡 Yellow (Sub-taxonomical Elements)**: Detailed sub-components
+- **⚫ Gray (Implementation Suggestions)**: Suggested methods and tools
+
+Additional metadata:
+- Asset types (devices, applications, users, etc.)
+- Security functions (Identify, Protect, Detect, Respond, Recover)
+- Relevant keywords for analysis engine
+
+### 4. Implement in Code
+```typescript
+// Add to CIS_SAFEGUARDS object in src/index.ts
+"X.Y": {
+  id: "X.Y",
+  title: "Safeguard Title",
+  description: "Description...",
+  implementationGroup: "IG1" | "IG2" | "IG3",
+  assetType: [...],
+  securityFunction: [...],
+  governanceElements: [...],      // Orange
+  coreRequirements: [...],        // Green
+  subTaxonomicalElements: [...],  // Yellow
+  implementationSuggestions: [...], // Gray
+  relatedSafeguards: [...],
+  keywords: [...]
+}
+```
+
+### 5. Test and Validate
+```bash
+npm run build  # Verify compilation
+# Test with sample vendor responses
+# Verify analysis engine processes new safeguards correctly
+```
+
+### 6. Document and Commit
+```bash
+git add .
+git commit -m "Add Control X: [Control Name] - implemented X.1 through X.Y safeguards
+
+- Extracted all safeguards from CISv8.1-Control X.pdf
+- Categorized elements using color-coding system  
+- Added appropriate keywords and metadata
+- Tested with analysis engine
+
+🤖 Generated with [Claude Code](https://claude.ai/code)
+
+Co-Authored-By: Claude <noreply@anthropic.com>"
+
+git push origin main
+```
+
+## Success Criteria for Each Control
+
+✅ **Extraction Complete**
+- [ ] All safeguards identified and extracted from PDF
+- [ ] Elements properly categorized (Orange/Green/Yellow/Gray)
+- [ ] Implementation Groups assigned correctly
+
+✅ **Code Implementation**
+- [ ] All safeguards added to CIS_SAFEGUARDS object
+- [ ] Consistent formatting with existing controls
+- [ ] Code compiles without errors
+- [ ] Proper TypeScript typing maintained
+
+✅ **Testing and Validation**
+- [ ] Analysis engine correctly processes new safeguards
+- [ ] Capability categorization works appropriately
+- [ ] Sample vendor responses produce expected results
+
+✅ **Documentation and Commit**
+- [ ] Progress tracking updated
+- [ ] Detailed commit message with control summary
+- [ ] Changes committed and pushed to repository
+
+## Progress Tracking
+
+### Completed Controls
+- ✅ Control 1: Inventory and Control of Enterprise Assets
+- ✅ Control 2: Inventory and Control of Software Assets  
+- ✅ Control 3: Data Protection
+- ✅ Control 4: Secure Configuration of Enterprise Assets and Software
+- ✅ Control 5: Account Management
+- ✅ Control 6: Access Control Management
+- ✅ Control 7: Continuous Vulnerability Management
+- ✅ **Control 8: Audit Log Management** (12 safeguards: 8.1-8.12)
+- ✅ **Control 10: Malware Defenses** (7 safeguards: 10.1-10.7)
+- ✅ **Control 11: Data Recovery** (5 safeguards: 11.1-11.5)
+- ✅ **Control 9: Email and Web Browser Protections** (7 safeguards: 9.1-9.7)
+- ✅ **Control 12: Network Infrastructure Management** (8 safeguards: 12.1-12.8)
+- ✅ **Control 13: Network Monitoring and Defense** (11 safeguards: 13.1-13.11)
+- ✅ **Control 14: Security Awareness and Skills Training** (9 safeguards: 14.1-14.9)
+- ✅ **Control 15: Service Provider Management** (7 safeguards: 15.1-15.7)
+- ✅ **Control 16: Application Software Security** (14 safeguards: 16.1-16.14)
+- ✅ **Control 17: Incident Response Management** (9 safeguards: 17.1-17.9)
+- ✅ **Control 18: Penetration Testing** (5 safeguards: 18.1-18.5)
+
+### ✅ ALL CONTROLS COMPLETE
+**Total Implementation**: 153 safeguards across all 18 CIS Controls v8.1
+
+### Final Status
+- [ ] **COMPLETE**: All CIS Controls v8.1 safeguards implemented
+- [ ] **Framework Ready**: Full vendor analysis capability enabled
+
+## Risk Mitigation
+
+### Context Limit Management
+- Process only one control per session to avoid PDF context limits
+- Use targeted reading with offsets if PDFs are very large
+- Focus on extracting structured information efficiently
+
+### Quality Assurance
+- Reference existing controls 1-7 as formatting templates
+- Validate element categorization against established patterns
+- Test each implementation before moving to next control
+
+### Recovery Strategy
+- Detailed progress tracking enables restart from any point
+- Each control is independent (no cascading failures)
+- Commit after each successful control completion
+- Can skip complex controls and return later if needed
+
+## Estimated Timeline
+- **Per Control**: 1-2 hours (extraction + implementation + testing)
+- **Total Remaining**: ~15-20 hours of focused work
+- **Completion Target**: Can be spread across multiple sessions safely
+
+---
+
+**Next Action**: Begin with Control 8 (Audit Log Management) using the standard session template.

package/dist/index.d.ts

@@ -1,3 +1,20 @@
 #!/usr/bin/env node
-export {};
+export declare class GRCAnalysisServer {
+    private server;
+    constructor();
+    private setupToolHandlers;
+    private getSafeguardDetails;
+    private listAvailableSafeguards;
+    private analyzeVendorResponse;
+    private validateCoverageClaim;
+    private performEnhancedSafeguardAnalysis;
+    private calculateKeywordScore;
+    private analyzeElementCoverage;
+    private analyzeBinaryElementCoverage;
+    private extractEnhancedEvidence;
+    private generateEnhancedReasoning;
+    private generateCapabilityReasoning;
+    private validateClaim;
+    run(): Promise<void>;
+}
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAo5KA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;;IAavB,OAAO,CAAC,iBAAiB;YAkIX,mBAAmB;YA8CnB,uBAAuB;YAuCvB,qBAAqB;YAoBrB,qBAAqB;IA8BnC,OAAO,CAAC,gCAAgC;IAqJxC,OAAO,CAAC,qBAAqB;IAgB7B,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,4BAA4B;IAwCpC,OAAO,CAAC,uBAAuB;IA6B/B,OAAO,CAAC,yBAAyB;IA4BjC,OAAO,CAAC,2BAA2B;IAuEnC,OAAO,CAAC,aAAa;IAsFf,GAAG;CAKV"}