mcp-adr-analysis-server 1.1.0

package/dist/src/prompts/security-prompts.js

@@ -0,0 +1,287 @@
+/**
+ * Security-focused prompts for content masking and secret detection
+ * Following prompt-driven development approach
+ */
+/**
+ * AI prompt for detecting sensitive information patterns in content
+ */
+export function generateSensitiveContentDetectionPrompt(content, contentType = 'general', userDefinedPatterns) {
+    return `
+# Sensitive Information Detection Request
+
+Please analyze the following content and identify any sensitive information that should be masked or redacted.
+
+## Content Type
+${contentType}
+
+## Content to Analyze
+\`\`\`
+${content.slice(0, 5000)}${content.length > 5000 ? '\n... (content truncated for analysis)' : ''}
+\`\`\`
+
+${userDefinedPatterns
+        ? `## User-Defined Sensitive Patterns
+${userDefinedPatterns.map(pattern => `- ${pattern}`).join('\n')}
+`
+        : ''}
+
+## Detection Requirements
+
+Please identify ALL instances of sensitive information including:
+
+### 🔑 **API Keys & Tokens**
+- API keys (AWS, Google, GitHub, Stripe, etc.)
+- Access tokens, bearer tokens, JWT tokens
+- OAuth client secrets and refresh tokens
+- Service account keys and credentials
+- Database connection tokens
+
+### 🔐 **Credentials & Authentication**
+- Passwords, passphrases, PINs
+- Private keys (RSA, SSH, SSL/TLS certificates)
+- Database usernames and passwords
+- SMTP credentials
+- FTP/SFTP credentials
+
+### 🌐 **Connection Strings & URLs**
+- Database connection strings with credentials
+- Redis/MongoDB connection URLs with auth
+- SMTP server configurations with passwords
+- Internal URLs with embedded credentials
+- Cloud service endpoints with keys
+
+### 📧 **Personal & Sensitive Data**
+- Email addresses (unless clearly public)
+- Phone numbers
+- IP addresses (internal/private ranges)
+- Social Security Numbers, credit card numbers
+- Personal names in sensitive contexts
+
+### 🏢 **Business Sensitive Information**
+- Internal server names and hostnames
+- Internal network configurations
+- Proprietary algorithms or business logic
+- Customer data or identifiers
+- Financial information
+
+## Analysis Output Format
+
+Please provide your analysis in the following JSON format:
+
+\`\`\`json
+{
+  "hasSensitiveContent": true/false,
+  "detectedItems": [
+    {
+      "type": "api_key|password|private_key|connection_string|email|phone|ip_address|other",
+      "category": "authentication|network|personal|business|crypto",
+      "content": "the actual sensitive content found",
+      "startPosition": 123,
+      "endPosition": 156,
+      "confidence": 0.0-1.0,
+      "reasoning": "why this is considered sensitive",
+      "severity": "low|medium|high|critical",
+      "suggestedMask": "how to mask this content"
+    }
+  ],
+  "recommendations": [
+    "specific recommendations for handling this content"
+  ],
+  "overallRisk": "low|medium|high|critical",
+  "summary": "brief summary of findings"
+}
+\`\`\`
+
+## Detection Guidelines
+
+1. **Be Conservative**: When in doubt, flag as potentially sensitive
+2. **Context Matters**: Consider the context and content type
+3. **Confidence Scoring**: Rate your confidence in each detection
+4. **Severity Assessment**: Evaluate the risk level of exposure
+5. **Practical Masking**: Suggest appropriate masking strategies
+
+## Masking Strategies
+
+- **Full Redaction**: \`[REDACTED]\` for highly sensitive content
+- **Partial Masking**: \`sk-...****\` for API keys (show prefix only)
+- **Type Indication**: \`[API_KEY_REDACTED]\` for specific types
+- **Placeholder**: \`<YOUR_API_KEY>\` for documentation examples
+- **Environment Variable**: \`\${API_KEY}\` for configuration templates
+
+Please analyze thoroughly and provide detailed, actionable results.
+`;
+}
+/**
+ * AI prompt for intelligent content masking decisions
+ */
+export function generateContentMaskingPrompt(content, detectedSensitiveItems, maskingStrategy = 'full') {
+    return `
+# Content Masking Request
+
+Please apply intelligent masking to the following content based on detected sensitive information.
+
+## Original Content
+\`\`\`
+${content}
+\`\`\`
+
+## Detected Sensitive Items
+${detectedSensitiveItems
+        .map((item, index) => `
+### Item ${index + 1}
+- **Type**: ${item.type}
+- **Content**: ${item.content}
+- **Position**: ${item.startPosition}-${item.endPosition}
+- **Severity**: ${item.severity}
+`)
+        .join('')}
+
+## Masking Strategy
+${maskingStrategy}
+
+## Masking Requirements
+
+Please apply appropriate masking based on the strategy:
+
+### **Full Masking**
+- Replace entire sensitive content with \`[REDACTED]\`
+- Maintain original content structure and readability
+- Preserve context for understanding
+
+### **Partial Masking**
+- Show safe prefix/suffix, mask middle portion
+- API keys: \`sk-...****\` or \`ghp_...****\`
+- Emails: \`user...@domain.com\`
+- IPs: \`192.168.*.***\`
+
+### **Placeholder Masking**
+- Replace with descriptive placeholders
+- \`<YOUR_API_KEY>\`, \`<DATABASE_PASSWORD>\`
+- Maintain documentation value
+
+### **Environment Variable Masking**
+- Replace with environment variable references
+- \`\${API_KEY}\`, \`\${DATABASE_URL}\`
+- Suitable for configuration files
+
+## Output Format
+
+Please provide the masked content in the following JSON format:
+
+\`\`\`json
+{
+  "maskedContent": "the content with sensitive information masked",
+  "maskingApplied": [
+    {
+      "originalContent": "sensitive content that was masked",
+      "maskedWith": "what it was replaced with",
+      "position": "start-end position",
+      "reason": "why this masking approach was chosen"
+    }
+  ],
+  "preservedStructure": true/false,
+  "readabilityScore": 0.0-1.0,
+  "securityScore": 0.0-1.0,
+  "recommendations": [
+    "additional security recommendations"
+  ]
+}
+\`\`\`
+
+## Masking Guidelines
+
+1. **Preserve Functionality**: Don't break code syntax or structure
+2. **Maintain Context**: Keep enough context for understanding
+3. **Consistent Approach**: Use consistent masking patterns
+4. **Documentation Friendly**: Ensure masked content is still useful
+5. **Security First**: Prioritize security over convenience
+
+Please apply intelligent masking that balances security with usability.
+`;
+}
+/**
+ * AI prompt for user-defined sensitive pattern configuration
+ */
+export function generateCustomPatternConfigurationPrompt(projectContext, existingPatterns) {
+    return `
+# Custom Sensitive Pattern Configuration
+
+Please help configure custom sensitive information patterns for this specific project.
+
+## Project Context
+\`\`\`
+${projectContext}
+\`\`\`
+
+${existingPatterns
+        ? `## Existing Patterns
+${existingPatterns.map(pattern => `- ${pattern}`).join('\n')}
+`
+        : ''}
+
+## Configuration Requirements
+
+Based on the project context, please suggest custom sensitive patterns that should be detected and masked.
+
+Consider:
+
+### **Project-Specific Patterns**
+- Custom API endpoints or service URLs
+- Internal service names or identifiers
+- Project-specific configuration keys
+- Custom authentication schemes
+- Business-specific data formats
+
+### **Technology-Specific Patterns**
+- Framework-specific configuration patterns
+- Database-specific connection formats
+- Cloud provider specific identifiers
+- Container orchestration secrets
+- CI/CD specific variables
+
+### **Domain-Specific Patterns**
+- Industry-specific identifiers
+- Regulatory compliance requirements
+- Customer-specific data formats
+- Partner integration credentials
+- Third-party service configurations
+
+## Output Format
+
+Please provide custom pattern configuration in JSON format:
+
+\`\`\`json
+{
+  "customPatterns": [
+    {
+      "name": "pattern name",
+      "description": "what this pattern detects",
+      "regex": "regular expression pattern",
+      "category": "api_key|credential|identifier|url|other",
+      "severity": "low|medium|high|critical",
+      "examples": ["example matches"],
+      "falsePositives": ["potential false positives to watch for"],
+      "maskingStrategy": "full|partial|placeholder|environment"
+    }
+  ],
+  "recommendations": [
+    "additional security recommendations for this project"
+  ],
+  "integrationNotes": [
+    "notes on integrating these patterns with existing detection"
+  ]
+}
+\`\`\`
+
+## Pattern Guidelines
+
+1. **Specific but Flexible**: Patterns should be specific to avoid false positives but flexible enough to catch variations
+2. **Performance Conscious**: Avoid overly complex regex that could impact performance
+3. **Maintainable**: Patterns should be easy to understand and modify
+4. **Context Aware**: Consider the specific technology stack and domain
+5. **Severity Appropriate**: Assign appropriate severity levels based on risk
+
+Please provide thoughtful, project-specific pattern recommendations.
+`;
+}
+//# sourceMappingURL=security-prompts.js.map

package/dist/src/prompts/security-prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-prompts.js","sourceRoot":"","sources":["../../../src/prompts/security-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAAe,EACf,cAA+E,SAAS,EACxF,mBAA8B;IAE9B,OAAO;;;;;;EAMP,WAAW;;;;EAIX,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,EAAE;;;EAI9F,mBAAmB;QACjB,CAAC,CAAC;EACJ,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CAC9D;QACG,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,sBAME,EACF,kBAAsE,MAAM;IAE5E,OAAO;;;;;;;EAOP,OAAO;;;;EAIP,sBAAsB;SACrB,GAAG,CACF,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;WACV,KAAK,GAAG,CAAC;cACN,IAAI,CAAC,IAAI;iBACN,IAAI,CAAC,OAAO;kBACX,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW;kBACtC,IAAI,CAAC,QAAQ;CAC9B,CACE;SACA,IAAI,CAAC,EAAE,CAAC;;;EAGT,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DhB,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAsB,EACtB,gBAA2B;IAE3B,OAAO;;;;;;;EAOP,cAAc;;;EAId,gBAAgB;QACd,CAAC,CAAC;EACJ,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CAC3D;QACG,CAAC,CAAC,EACN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEC,CAAC;AACF,CAAC"}

package/dist/src/resources/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * MCP Resource implementations using prompt-driven approach
+ * Generates structured data resources for architectural analysis
+ */
+export interface ResourceGenerationResult {
+    data: any;
+    contentType: string;
+    lastModified: string;
+    cacheKey: string;
+    ttl: number;
+}
+/**
+ * Generate architectural knowledge graph resource
+ */
+export declare function generateArchitecturalKnowledgeGraph(projectPath: string): Promise<ResourceGenerationResult>;
+/**
+ * Generate analysis report resource
+ */
+export declare function generateAnalysisReport(projectPath: string, focusAreas?: string[]): Promise<ResourceGenerationResult>;
+/**
+ * Generate ADR list resource
+ */
+export declare function generateAdrList(adrDirectory?: string): Promise<ResourceGenerationResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/resources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resources/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,GAAG,CAAC;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,wBAAsB,mCAAmC,CACvD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,wBAAwB,CAAC,CA4JnC;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,wBAAwB,CAAC,CA2JnC;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,YAAY,GAAE,MAAoB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA4JnC"}