framework-mcp 1.3.5 → 1.3.7

package/src/interfaces/http/http-server.ts

@@ -74,47 +74,11 @@ export class FrameworkHttpServer {
         uptime: Math.round((Date.now() - metrics.uptime) / 1000),
         totalRequests: metrics.totalRequests,
         errorCount: metrics.errorCount,
-        version: '1.3.4',
+        version: '1.3.7',
         timestamp: new Date().toISOString()
       });
     });
 
-    // Primary validation endpoint
-    this.app.post('/api/validate-vendor-mapping', async (req, res) => {
-      try {
-        const { vendor_name, safeguard_id, claimed_capability, supporting_text } = req.body;
-
-        // Input validation
-        this.validateInput(req.body, [
-          'vendor_name',
-          'safeguard_id', 
-          'claimed_capability',
-          'supporting_text'
-        ]);
-
-        this.validateTextInput(supporting_text, 'Supporting text');
-        this.validateCapability(claimed_capability);
-        this.safeguardManager.validateSafeguardId(safeguard_id);
-
-        const safeguard = this.safeguardManager.getSafeguardDetails(safeguard_id);
-        if (!safeguard) {
-          return res.status(404).json(this.createErrorResponse('Safeguard not found'));
-        }
-
-        const result = this.capabilityAnalyzer.validateVendorMapping(
-          vendor_name,
-          safeguard_id,
-          claimed_capability,
-          supporting_text,
-          safeguard
-        );
-
-        res.json(result);
-      } catch (error) {
-        console.error('[HTTP Server] validate-vendor-mapping error:', error);
-        res.status(400).json(this.createErrorResponse(error instanceof Error ? error.message : 'Unknown error'));
-      }
-    });
 
     // Capability analysis endpoint
     this.app.post('/api/analyze-vendor-response', async (req, res) => {
@@ -205,11 +169,10 @@ export class FrameworkHttpServer {
     this.app.get('/api', (req, res) => {
       res.json({
         name: 'Framework MCP HTTP API',
-        version: '1.3.4',
-        description: 'Dual-architecture HTTP API for vendor capability assessment against CIS Controls Framework',
+        version: '1.3.7',
+        description: 'Clean HTTP API for vendor capability assessment against CIS Controls Framework',
         endpoints: {
-          'POST /api/validate-vendor-mapping': 'Primary capability validation with domain validation',
-          'POST /api/analyze-vendor-response': 'Capability role determination for vendor responses',
+          'POST /api/analyze-vendor-response': 'Primary capability analysis for vendor responses',
           'GET /api/safeguards': 'List all available CIS safeguards',
           'GET /api/safeguards/:id': 'Get detailed safeguard breakdown',
           'GET /health': 'Health check endpoint',
@@ -223,7 +186,6 @@ export class FrameworkHttpServer {
           'GOVERNANCE - Policy/process management',
           'VALIDATES - Evidence collection and reporting'
         ],
-        domain_validation: 'Auto-downgrade protection for inappropriate capability claims',
         framework: 'CIS Controls v8.1 (153 safeguards)',
         deployment: 'DigitalOcean App Services compatible'
       });
@@ -301,11 +263,11 @@ export class FrameworkHttpServer {
 
   public start(): void {
     this.app.listen(this.port, '0.0.0.0', () => {
-      console.log(`🚀 Framework MCP HTTP Server v1.3.4 running on port ${this.port}`);
+      console.log(`🚀 Framework MCP HTTP Server v1.3.7 running on port ${this.port}`);
       console.log(`📊 Health check: http://localhost:${this.port}/health`);
       console.log(`📖 API docs: http://localhost:${this.port}/api`);
       console.log(`🔧 Environment: ${process.env.NODE_ENV || 'development'}`);
-      console.log(`⚡ DigitalOcean App Services compatible`);
+      console.log(`⚡ Clean capability analysis - CIS Controls v8.1`);
     });
 
     // Graceful shutdown handling

package/src/interfaces/mcp/mcp-server.ts

@@ -20,7 +20,7 @@ export class FrameworkMcpServer {
     this.server = new Server(
       {
         name: 'framework-analyzer',
-        version: '1.3.4',
+        version: '1.3.7',
       }
     );
 
@@ -35,33 +35,6 @@ export class FrameworkMcpServer {
     this.server.setRequestHandler(ListToolsRequestSchema, async () => {
       return {
         tools: [
-          {
-            name: 'validate_vendor_mapping',
-            description: 'PRIMARY: Validate vendor capability claims with domain validation and evidence analysis',
-            inputSchema: {
-              type: 'object',
-              properties: {
-                vendor_name: {
-                  type: 'string',
-                  description: 'Name of the vendor/tool being analyzed'
-                },
-                safeguard_id: {
-                  type: 'string',
-                  description: 'CIS safeguard ID (e.g., "1.1", "5.1")'
-                },
-                claimed_capability: {
-                  type: 'string',
-                  description: 'Claimed capability role',
-                  enum: ['full', 'partial', 'facilitates', 'governance', 'validates']
-                },
-                supporting_text: {
-                  type: 'string',
-                  description: 'Vendor text supporting their capability claim'
-                }
-              },
-              required: ['vendor_name', 'safeguard_id', 'claimed_capability', 'supporting_text']
-            }
-          } as Tool,
           {
             name: 'analyze_vendor_response',
             description: 'Determine vendor tool capability role for specific safeguard',
@@ -121,9 +94,6 @@ export class FrameworkMcpServer {
 
       try {
         switch (name) {
-          case 'validate_vendor_mapping':
-            return await this.validateVendorMapping(args);
-
           case 'analyze_vendor_response':
             return await this.analyzeVendorResponse(args);
 
@@ -155,36 +125,6 @@ export class FrameworkMcpServer {
     });
   }
 
-  private async validateVendorMapping(args: any) {
-    const { vendor_name = 'Unknown Vendor', safeguard_id, claimed_capability, supporting_text } = args;
-
-    // Input validation
-    this.validateTextInput(supporting_text, 'Supporting text');
-    this.validateCapability(claimed_capability);
-    this.safeguardManager.validateSafeguardId(safeguard_id);
-
-    const safeguard = this.safeguardManager.getSafeguardDetails(safeguard_id);
-    if (!safeguard) {
-      throw new Error(`Safeguard ${safeguard_id} not found`);
-    }
-
-    const validation = this.capabilityAnalyzer.validateVendorMapping(
-      vendor_name, 
-      safeguard_id,
-      claimed_capability,
-      supporting_text,
-      safeguard
-    );
-
-    return {
-      content: [
-        {
-          type: 'text',
-          text: JSON.stringify(validation, null, 2),
-        },
-      ],
-    };
-  }
 
   private async analyzeVendorResponse(args: any) {
     const { vendor_name = 'Unknown Vendor', safeguard_id, response_text } = args;
@@ -240,7 +180,7 @@ export class FrameworkMcpServer {
             safeguards,
             total: safeguards.length,
             framework: 'CIS Controls v8.1',
-            version: '1.3.4'
+            version: '1.3.7'
           }, null, 2),
         },
       ],
@@ -294,8 +234,8 @@ export class FrameworkMcpServer {
     const transport = new StdioServerTransport();
     await this.server.connect(transport);
     
-    console.error('🤖 Framework MCP Server v1.3.4 running via stdio');
-    console.error('📊 Capability assessment with domain validation enabled');
+    console.error('🤖 Framework MCP Server v1.3.7 running via stdio');
+    console.error('📊 Clean capability assessment for CIS Controls v8.1');
   }
 }
 

package/src/shared/types.ts

@@ -38,31 +38,6 @@ export interface VendorAnalysis {
   recommendedUse: string;             // How practitioners should use this tool
 }
 
-export interface DomainValidationResult {
-  vendor: string;
-  safeguard_id: string;
-  safeguard_title: string;
-  claimed_capability: string;
-  validation_status: 'SUPPORTED' | 'QUESTIONABLE' | 'UNSUPPORTED';
-  confidence_score: number;
-  evidence_analysis: {
-    core_requirements_coverage: number;
-    sub_elements_coverage: number;
-    governance_alignment: number;
-    language_consistency: number;
-  };
-  domain_validation: {
-    required_tool_type: string;
-    detected_tool_type: string;
-    domain_match: boolean;
-    capability_adjusted: boolean;
-    original_claim?: string;
-  };
-  gaps_identified: string[];
-  strengths_identified: string[];
-  recommendations: string[];
-  detailed_feedback: string;
-}
 
 export interface PerformanceMetrics {
   uptime: number;
@@ -87,18 +62,3 @@ export interface QualityAssessment {
 
 export type CapabilityType = 'full' | 'partial' | 'facilitates' | 'governance' | 'validates';
 
-// Domain-specific validation mapping
-export interface DomainRequirement {
-  domain: string;
-  required_tool_types: string[];
-  description: string;
-}
-
-// Tool type detection weights
-export interface ToolTypeWeights {
-  [toolType: string]: {
-    keywords: string[];
-    baseWeight: number;
-    contextBonuses: string[];
-  };
-}

package/swagger.json

@@ -2,8 +2,8 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Framework MCP API - CIS Controls Capability Assessment",
-    "description": "Microsoft Copilot-compatible API for vendor capability assessment against CIS Controls Framework v8.1 (153 safeguards). Features consolidated tool architecture with domain validation and auto-downgrade protection for accurate capability role determination (FULL, PARTIAL, FACILITATES, GOVERNANCE, VALIDATES).",
-    "version": "1.3.5",
+    "description": "Microsoft Copilot-compatible API for vendor capability assessment against CIS Controls Framework v8.1 (153 safeguards). Features clean capability analysis architecture for accurate capability role determination (FULL, PARTIAL, FACILITATES, GOVERNANCE, VALIDATES).",
+    "version": "1.3.7",
     "contact": {
       "name": "Framework MCP Support",
       "url": "https://github.com/therealcybermattlee/FrameworkMCP"
@@ -44,60 +44,10 @@
         }
       }
     },
-    "/api/validate-vendor-mapping": {
-      "post": {
-        "summary": "Validate Vendor Capability Mapping (PRIMARY)",
-        "description": "Primary endpoint for validating vendor capability claims against CIS safeguards with domain validation and auto-downgrade protection. Use this for evidence-based capability assessment.",
-        "operationId": "validateVendorMapping",
-        "tags": ["Capability Assessment"],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/VendorMappingRequest"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Validation completed successfully",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ValidationResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid request parameters",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorResponse"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "Safeguard not found",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ErrorResponse"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
     "/api/analyze-vendor-response": {
       "post": {
-        "summary": "Analyze Vendor Response",
-        "description": "Analyze vendor response text to determine appropriate capability role with domain validation",
+        "summary": "Analyze Vendor Response (PRIMARY)",
+        "description": "Primary endpoint for analyzing vendor response text to determine appropriate capability role for CIS safeguards",
         "operationId": "analyzeVendorResponse",
         "tags": ["Capability Assessment"],
         "requestBody": {
@@ -116,7 +66,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AnalysisResponse"
+                  "$ref": "#/components/schemas/VendorAnalysisResponse"
                 }
               }
             }
@@ -246,6 +196,26 @@
           }
         }
       }
+    },
+    "/api": {
+      "get": {
+        "summary": "API Documentation",
+        "description": "Get API documentation and available endpoints information",
+        "operationId": "getApiDocumentation",
+        "tags": ["Monitoring"],
+        "responses": {
+          "200": {
+            "description": "API documentation and endpoints",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiDocumentationResponse"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   "components": {
@@ -253,36 +223,7 @@
       "CapabilityRole": {
         "type": "string",
         "enum": ["full", "partial", "facilitates", "governance", "validates"],
-        "description": "Vendor tool capability roles:\n- FULL: Complete implementation of safeguard (requires domain-appropriate tool)\n- PARTIAL: Limited scope implementation (requires domain-appropriate tool)\n- FACILITATES: Enhancement capabilities (no tool type restrictions)\n- GOVERNANCE: Policy/process management (no tool type restrictions)\n- VALIDATES: Evidence collection and reporting (no tool type restrictions)"
-      },
-      "VendorMappingRequest": {
-        "type": "object",
-        "required": ["vendor_name", "safeguard_id", "claimed_capability", "supporting_text"],
-        "properties": {
-          "vendor_name": {
-            "type": "string",
-            "description": "Name of the vendor or tool being analyzed",
-            "minLength": 1,
-            "maxLength": 100,
-            "example": "CrowdStrike Falcon"
-          },
-          "safeguard_id": {
-            "type": "string",
-            "pattern": "^[0-9]+\\.[0-9]+$",
-            "description": "CIS safeguard ID (format: X.Y)",
-            "example": "1.1"
-          },
-          "claimed_capability": {
-            "$ref": "#/components/schemas/CapabilityRole"
-          },
-          "supporting_text": {
-            "type": "string",
-            "description": "Vendor response or documentation supporting their capability claim",
-            "minLength": 10,
-            "maxLength": 10000,
-            "example": "Our platform provides comprehensive enterprise asset inventory with real-time discovery, automated classification, and continuous monitoring of all hardware and software assets across the organization."
-          }
-        }
+        "description": "Vendor tool capability roles:\n- FULL: Complete implementation of safeguard\n- PARTIAL: Limited scope implementation\n- FACILITATES: Enhancement capabilities that enable better/faster/stronger implementation\n- GOVERNANCE: Policy/process management and oversight\n- VALIDATES: Evidence collection, audit, and reporting"
       },
       "AnalysisRequest": {
         "type": "object",
@@ -310,147 +251,78 @@
           }
         }
       },
-      "ValidationResponse": {
+      "VendorAnalysisResponse": {
         "type": "object",
         "properties": {
-          "vendor_name": {
+          "vendor": {
             "type": "string",
-            "example": "CrowdStrike Falcon"
+            "description": "Name of the vendor or tool",
+            "example": "Microsoft Defender"
           },
-          "safeguard_id": {
+          "safeguardId": {
             "type": "string",
-            "example": "1.1"
-          },
-          "claimed_capability": {
-            "$ref": "#/components/schemas/CapabilityRole"
-          },
-          "validated_capability": {
-            "$ref": "#/components/schemas/CapabilityRole"
+            "description": "CIS safeguard ID",
+            "example": "5.1"
           },
-          "validation_status": {
+          "safeguardTitle": {
             "type": "string",
-            "enum": ["SUPPORTED", "QUESTIONABLE", "UNSUPPORTED"],
-            "description": "Overall validation result"
+            "description": "Title of the CIS safeguard",
+            "example": "Establish and Maintain an Inventory of Accounts"
           },
-          "confidence_score": {
-            "type": "number",
-            "minimum": 0,
-            "maximum": 100,
-            "description": "Confidence percentage in the assessment"
+          "capability": {
+            "$ref": "#/components/schemas/CapabilityRole",
+            "description": "Primary capability categorization"
           },
-          "domain_validation": {
+          "capabilities": {
             "type": "object",
+            "description": "Detailed capability breakdown",
             "properties": {
-              "tool_type": {
-                "type": "string",
-                "description": "Detected tool type category"
-              },
-              "domain_appropriate": {
+              "full": {
                 "type": "boolean",
-                "description": "Whether tool type is appropriate for claimed capability"
+                "description": "Directly implements the core safeguard functionality"
               },
-              "auto_downgrade_applied": {
+              "partial": {
                 "type": "boolean",
-                "description": "Whether capability was auto-downgraded due to domain mismatch"
-              }
-            }
-          },
-          "evidence_analysis": {
-            "type": "object",
-            "properties": {
-              "core_requirements_score": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
+                "description": "Implements limited aspects of the safeguard"
               },
-              "governance_elements_score": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
+              "facilitates": {
+                "type": "boolean",
+                "description": "Enhances or enables safeguard implementation by others"
               },
-              "sub_elements_score": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
+              "governance": {
+                "type": "boolean",
+                "description": "Provides policy, process, and oversight capabilities"
               },
-              "language_consistency_score": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
+              "validates": {
+                "type": "boolean",
+                "description": "Provides evidence, audit, and validation reporting"
               }
             }
           },
+          "confidence": {
+            "type": "number",
+            "minimum": 0,
+            "maximum": 100,
+            "description": "Confidence score in the assessment"
+          },
           "reasoning": {
             "type": "string",
-            "description": "Detailed explanation of the validation decision"
+            "description": "Detailed explanation of the capability determination"
           },
-          "recommendations": {
+          "evidence": {
             "type": "array",
             "items": {
               "type": "string"
             },
-            "description": "Actionable recommendations for capability improvement"
+            "description": "Evidence supporting the capability assessment"
           },
-          "timestamp": {
+          "toolCapabilityDescription": {
             "type": "string",
-            "format": "date-time"
-          }
-        }
-      },
-      "AnalysisResponse": {
-        "type": "object",
-        "properties": {
-          "vendor_name": {
-            "type": "string"
-          },
-          "safeguard_id": {
-            "type": "string"
-          },
-          "determined_capability": {
-            "$ref": "#/components/schemas/CapabilityRole"
-          },
-          "confidence_score": {
-            "type": "number",
-            "minimum": 0,
-            "maximum": 100
+            "description": "Description of what type of tool this is and its role"
           },
-          "domain_validation": {
-            "type": "object",
-            "properties": {
-              "tool_type": {
-                "type": "string"
-              },
-              "domain_appropriate": {
-                "type": "boolean"
-              }
-            }
-          },
-          "analysis_details": {
-            "type": "object",
-            "properties": {
-              "core_coverage": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
-              },
-              "implementation_depth": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
-              },
-              "governance_support": {
-                "type": "number",
-                "minimum": 0,
-                "maximum": 100
-              }
-            }
-          },
-          "reasoning": {
-            "type": "string"
-          },
-          "timestamp": {
+          "recommendedUse": {
             "type": "string",
-            "format": "date-time"
+            "description": "How practitioners should use this tool for the safeguard"
           }
         }
       },
@@ -563,7 +435,7 @@
           },
           "version": {
             "type": "string",
-            "example": "1.3.4"
+            "example": "1.3.7"
           },
           "timestamp": {
             "type": "string",
@@ -599,6 +471,45 @@
           }
         }
       },
+      "ApiDocumentationResponse": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "example": "Framework MCP HTTP API"
+          },
+          "version": {
+            "type": "string",
+            "example": "1.3.7"
+          },
+          "description": {
+            "type": "string",
+            "example": "Clean HTTP API for vendor capability assessment against CIS Controls Framework"
+          },
+          "endpoints": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Available API endpoints and their descriptions"
+          },
+          "capabilities": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Supported capability types"
+          },
+          "framework": {
+            "type": "string",
+            "example": "CIS Controls v8.1 (153 safeguards)"
+          },
+          "deployment": {
+            "type": "string",
+            "example": "DigitalOcean App Services compatible"
+          }
+        }
+      },
       "ErrorResponse": {
         "type": "object",
         "properties": {