iso27001-mcp 0.8.1 → 0.8.2

package/README.md

@@ -1,7 +1,8 @@
 # iso27001-mcp
 
-[![Socket Badge](https://badge.socket.dev/npm/package/iso27001-mcp/0.8.1)](https://socket.dev/npm/package/iso27001-mcp/overview/0.8.1)
+[![Socket Badge](https://badge.socket.dev/npm/package/iso27001-mcp/0.8.2)](https://socket.dev/npm/package/iso27001-mcp/overview/0.8.2)
 [![npm version](https://img.shields.io/npm/v/iso27001-mcp.svg)](https://npmjs.com/package/iso27001-mcp)
+[![npm downloads](https://img.shields.io/npm/dt/iso27001-mcp.svg)](https://npmjs.com/package/iso27001-mcp)
 [![Live Demo](https://img.shields.io/badge/demo-live-blue)](https://sushegaad.github.io/MCP-Server-for-ISO27001/)
 
 **[▶ Live Interactive Demo](https://sushegaad.github.io/MCP-Server-for-ISO27001/)**
@@ -49,8 +50,10 @@ Claude ──MCP──► iso27001-mcp ──► encrypted SQLite (isms.db)
 - [Architecture](#architecture)
 - [Modes](#modes)
 - [Integrations](#integrations)
+- [Sample Outputs](#sample-outputs)
 - [Development](#development)
 - [Security](#security)
+  - [Trust Center](https://github.com/Sushegaad/MCP-Server-for-ISO27001/tree/main/docs/security/) — threat model · hardening guide · data flow · supply chain · audit log integrity
 
 ---
 
@@ -306,6 +309,7 @@ Full variable reference:
 | `SESSION_TTL_HOURS` | | `4` | SSE session TTL (hosted/team modes) |
 | `SSE_PORT` | | `3000` | Port for the SSE server (hosted/team modes) |
 | `BEHIND_TLS_PROXY` | | `false` | Set `true` when behind nginx/Caddy in production |
+| `CORS_ORIGIN` | | `http://localhost` (dev) / `https://claude.ai` (prod) | Allowed CORS origin for the SSE server — never set to `*` |
 | `JIRA_BASE_URL` | | — | e.g. `https://your-org.atlassian.net` |
 | `JIRA_API_TOKEN` | | — | Jira API token for the integration |
 | `JIRA_PROJECT_KEY` | | — | e.g. `SEC` |
@@ -1248,6 +1252,24 @@ Sessions expire after `SESSION_TTL_HOURS` hours of inactivity. In `NODE_ENV=prod
 
 ---
 
+## Sample Outputs
+
+The [`samples/`](samples/) directory contains auditor-ready example outputs generated from a demo ISMS for a fictitious organisation ("Acme Financial Services Ltd" — a UK payments processor preparing for ISO 27001:2022 certification). Each file states which tool(s) produced it.
+
+| Sample | Description |
+|--------|-------------|
+| [gap-assessment-summary.md](samples/gap-assessment-summary.md) | Complete gap assessment across all 93 controls |
+| [remediation-roadmap.md](samples/remediation-roadmap.md) | 26-week prioritised remediation plan with owners and effort estimates |
+| [risk-register.csv](samples/risk-register.csv) | Risk register with 10 risks, scores, and treatment plans |
+| [statement-of-applicability.csv](samples/statement-of-applicability.csv) | Full SoA — all 93 ISO 27001:2022 controls with applicability justifications |
+| [access-control-policy.md](samples/access-control-policy.md) | Generated access control policy (Annex A 5.15–5.18, 8.2–8.5) |
+| [incident-handling-procedure.md](samples/incident-handling-procedure.md) | Incident handling procedure with severity tiers and GDPR notification |
+| [internal-audit-report.md](samples/internal-audit-report.md) | Internal audit report — 3 major NCs, 4 minor NCs, 2 positive observations |
+| [corrective-action-record.md](samples/corrective-action-record.md) | Two corrective action records: one in progress, one closed and verified |
+| [evidence-package.md](samples/evidence-package.md) | 47-item evidence inventory with 28-control gap analysis |
+
+---
+
 ## Integrations
 
 ### Jira
@@ -1379,6 +1401,8 @@ tests/
 
 ## Security
 
+For a full security profile — threat model, hardening guide, data flow documentation, supply chain attestation, and audit log integrity verification — see the **[Trust Center](https://github.com/Sushegaad/MCP-Server-for-ISO27001/tree/main/docs/security/)**.
+
 ### API Key Storage
 
 API keys are never stored in plaintext. Only an HMAC-SHA256 hash is persisted in the database. The raw `iso27001_...` key is printed once to stdout at generation time — there is no way to retrieve it afterwards.

package/dist/index.js

@@ -24797,7 +24797,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "iso27001-mcp",
-      version: "0.8.1",
+      version: "0.8.2",
       description: "Stateful ISO 27001:2022 ISMS management for Claude \u2014 gap analysis, risk register, policies, audits, and evidence tracking via the Model Context Protocol",
       license: "MIT",
       repository: {
@@ -26650,7 +26650,7 @@ function startSseServer(server) {
   }
   const app = (0, import_express.default)();
   app.use((req, res, next) => {
-    const allowedOrigin = isProduction ? "https://claude.ai" : "*";
+    const allowedOrigin = process.env["CORS_ORIGIN"] ?? (isProduction ? "https://claude.ai" : "http://localhost");
     res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
     res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
     res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
@@ -26675,7 +26675,7 @@ function startSseServer(server) {
   });
   app.get("/sse", async (req, res) => {
     const authHeader = req.headers["authorization"];
-    const rawKey = (authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null) ?? process.env["MCP_API_KEY"] ?? "";
+    const rawKey = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
     let keyHash;
     let role;
     try {
@@ -26686,7 +26686,7 @@ function startSseServer(server) {
       res.status(401).json({
         error: "Unauthorized",
         message: msg,
-        hint: "Pass Authorization: Bearer <iso27001_...> header at connect time."
+        hint: "Pass 'Authorization: Bearer <iso27001_...>' header at /sse connect time. MCP_API_KEY env fallback is not accepted over SSE."
       });
       return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iso27001-mcp",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Stateful ISO 27001:2022 ISMS management for Claude — gap analysis, risk register, policies, audits, and evidence tracking via the Model Context Protocol",
   "license": "MIT",
   "repository": {