monomind 2.7.5 → 2.7.6

package/packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/audit-compliance.d.ts

@@ -1,170 +0,0 @@
-/**
- * audit-compliance.ts - Compliance auditing MCP tool handler
- *
- * Generates comprehensive compliance audit reports for various security
- * frameworks including OWASP, PCI-DSS, HIPAA, GDPR, and SOC2.
- */
-import { z } from 'zod';
-export declare const AuditComplianceInputSchema: z.ZodObject<{
-    targetPath: z.ZodString;
-    frameworks: z.ZodDefault<z.ZodArray<z.ZodEnum<["owasp-top-10", "sans-25", "pci-dss", "hipaa", "gdpr", "soc2", "nist"]>, "many">>;
-    auditType: z.ZodDefault<z.ZodEnum<["full", "quick", "delta"]>>;
-    includeEvidence: z.ZodDefault<z.ZodBoolean>;
-    includeRemediation: z.ZodDefault<z.ZodBoolean>;
-    lastAuditDate: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    targetPath: string;
-    includeRemediation: boolean;
-    frameworks: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2" | "nist")[];
-    auditType: "full" | "quick" | "delta";
-    includeEvidence: boolean;
-    lastAuditDate?: string | undefined;
-}, {
-    targetPath: string;
-    includeRemediation?: boolean | undefined;
-    frameworks?: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2" | "nist")[] | undefined;
-    auditType?: "full" | "quick" | "delta" | undefined;
-    includeEvidence?: boolean | undefined;
-    lastAuditDate?: string | undefined;
-}>;
-export type AuditComplianceInput = z.infer<typeof AuditComplianceInputSchema>;
-export interface AuditComplianceOutput {
-    success: boolean;
-    auditSummary: AuditSummary;
-    frameworkResults: FrameworkAuditResult[];
-    controls: ControlAssessment[];
-    gaps: ComplianceGap[];
-    remediationPlan: RemediationPlan | null;
-    evidence: EvidenceCollection[];
-    metadata: AuditMetadata;
-}
-export interface AuditSummary {
-    overallScore: number;
-    overallStatus: 'compliant' | 'partial' | 'non-compliant';
-    frameworkCount: number;
-    controlsAssessed: number;
-    controlsPassed: number;
-    controlsFailed: number;
-    criticalGaps: number;
-    riskLevel: 'low' | 'medium' | 'high' | 'critical';
-}
-export interface FrameworkAuditResult {
-    framework: string;
-    version: string;
-    score: number;
-    status: 'compliant' | 'partial' | 'non-compliant';
-    controlsPassed: number;
-    controlsFailed: number;
-    controlsNA: number;
-    categories: CategoryResult[];
-    requiredActions: string[];
-}
-export interface CategoryResult {
-    name: string;
-    score: number;
-    status: 'pass' | 'partial' | 'fail';
-    controls: number;
-    findings: number;
-}
-export interface ControlAssessment {
-    id: string;
-    framework: string;
-    category: string;
-    title: string;
-    description: string;
-    status: 'pass' | 'fail' | 'partial' | 'na';
-    severity: 'critical' | 'high' | 'medium' | 'low';
-    evidence: string[];
-    findings: string[];
-    remediation?: string;
-}
-export interface ComplianceGap {
-    id: string;
-    framework: string;
-    controlId: string;
-    title: string;
-    description: string;
-    severity: 'critical' | 'high' | 'medium' | 'low';
-    businessImpact: string;
-    remediationEffort: 'low' | 'medium' | 'high';
-    deadline?: string;
-}
-export interface RemediationPlan {
-    priority: RemediationItem[];
-    timeline: TimelineItem[];
-    estimatedEffort: string;
-    resourcesRequired: string[];
-}
-export interface RemediationItem {
-    priority: number;
-    gap: string;
-    action: string;
-    owner: string;
-    effort: 'low' | 'medium' | 'high';
-    deadline: string;
-}
-export interface TimelineItem {
-    phase: string;
-    duration: string;
-    activities: string[];
-    milestones: string[];
-}
-export interface EvidenceCollection {
-    controlId: string;
-    type: 'automated' | 'manual' | 'documented';
-    description: string;
-    artifacts: string[];
-    collectedAt: string;
-    validity: 'current' | 'expired' | 'pending';
-}
-export interface AuditMetadata {
-    auditedAt: string;
-    durationMs: number;
-    auditor: string;
-    auditType: string;
-    scopeFiles: number;
-    controlsChecked: number;
-}
-export interface ToolContext {
-    get<T>(key: string): T | undefined;
-}
-/**
- * MCP Tool Handler for audit-compliance
- */
-export declare function handler(input: AuditComplianceInput, context: ToolContext): Promise<{
-    content: Array<{
-        type: 'text';
-        text: string;
-    }>;
-}>;
-export declare const toolDefinition: {
-    name: string;
-    description: string;
-    category: string;
-    version: string;
-    inputSchema: z.ZodObject<{
-        targetPath: z.ZodString;
-        frameworks: z.ZodDefault<z.ZodArray<z.ZodEnum<["owasp-top-10", "sans-25", "pci-dss", "hipaa", "gdpr", "soc2", "nist"]>, "many">>;
-        auditType: z.ZodDefault<z.ZodEnum<["full", "quick", "delta"]>>;
-        includeEvidence: z.ZodDefault<z.ZodBoolean>;
-        includeRemediation: z.ZodDefault<z.ZodBoolean>;
-        lastAuditDate: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        targetPath: string;
-        includeRemediation: boolean;
-        frameworks: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2" | "nist")[];
-        auditType: "full" | "quick" | "delta";
-        includeEvidence: boolean;
-        lastAuditDate?: string | undefined;
-    }, {
-        targetPath: string;
-        includeRemediation?: boolean | undefined;
-        frameworks?: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2" | "nist")[] | undefined;
-        auditType?: "full" | "quick" | "delta" | undefined;
-        includeEvidence?: boolean | undefined;
-        lastAuditDate?: string | undefined;
-    }>;
-    handler: typeof handler;
-};
-export default toolDefinition;
-//# sourceMappingURL=audit-compliance.d.ts.map

package/packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/audit-compliance.js

@@ -1,394 +0,0 @@
-/**
- * audit-compliance.ts - Compliance auditing MCP tool handler
- *
- * Generates comprehensive compliance audit reports for various security
- * frameworks including OWASP, PCI-DSS, HIPAA, GDPR, and SOC2.
- */
-import { z } from 'zod';
-// Input schema for audit-compliance tool
-export const AuditComplianceInputSchema = z.object({
-    targetPath: z.string().describe('Path to project/codebase to audit'),
-    frameworks: z
-        .array(z.enum(['owasp-top-10', 'sans-25', 'pci-dss', 'hipaa', 'gdpr', 'soc2', 'nist']))
-        .default(['owasp-top-10'])
-        .describe('Compliance frameworks to audit'),
-    auditType: z
-        .enum(['full', 'quick', 'delta'])
-        .default('full')
-        .describe('Type of audit - full, quick, or delta from last audit'),
-    includeEvidence: z.boolean().default(true).describe('Include evidence collection'),
-    includeRemediation: z.boolean().default(true).describe('Include remediation plan'),
-    lastAuditDate: z.string().optional().describe('Last audit date for delta audits'),
-});
-/**
- * MCP Tool Handler for audit-compliance
- */
-export async function handler(input, context) {
-    const startTime = Date.now();
-    try {
-        // Validate input
-        const validatedInput = AuditComplianceInputSchema.parse(input);
-        // Perform audit for each framework
-        const frameworkResults = [];
-        const allControls = [];
-        const allGaps = [];
-        const allEvidence = [];
-        for (const framework of validatedInput.frameworks) {
-            const result = await auditFramework(framework, validatedInput.targetPath, validatedInput.auditType);
-            frameworkResults.push(result.frameworkResult);
-            allControls.push(...result.controls);
-            allGaps.push(...result.gaps);
-            if (validatedInput.includeEvidence) {
-                allEvidence.push(...result.evidence);
-            }
-        }
-        // Calculate overall summary
-        const auditSummary = calculateAuditSummary(frameworkResults, allGaps);
-        // Generate remediation plan if requested
-        const remediationPlan = validatedInput.includeRemediation
-            ? generateRemediationPlan(allGaps)
-            : null;
-        // Build result
-        const result = {
-            success: true,
-            auditSummary,
-            frameworkResults,
-            controls: allControls,
-            gaps: allGaps,
-            remediationPlan,
-            evidence: allEvidence,
-            metadata: {
-                auditedAt: new Date().toISOString(),
-                durationMs: Date.now() - startTime,
-                auditor: 'agentic-qe',
-                auditType: validatedInput.auditType,
-                scopeFiles: 50,
-                controlsChecked: allControls.length,
-            },
-        };
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify(result, null, 2),
-                },
-            ],
-        };
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({
-                        success: false,
-                        error: errorMessage,
-                        metadata: {
-                            auditedAt: new Date().toISOString(),
-                            durationMs: Date.now() - startTime,
-                        },
-                    }, null, 2),
-                },
-            ],
-        };
-    }
-}
-async function auditFramework(framework, targetPath, auditType) {
-    const frameworkConfigs = {
-        'owasp-top-10': {
-            version: '2021',
-            categories: [
-                { name: 'A01:2021-Broken Access Control', controlCount: 5 },
-                { name: 'A02:2021-Cryptographic Failures', controlCount: 4 },
-                { name: 'A03:2021-Injection', controlCount: 5 },
-                { name: 'A04:2021-Insecure Design', controlCount: 4 },
-                { name: 'A05:2021-Security Misconfiguration', controlCount: 5 },
-                { name: 'A06:2021-Vulnerable Components', controlCount: 3 },
-                { name: 'A07:2021-Authentication Failures', controlCount: 5 },
-                { name: 'A08:2021-Data Integrity Failures', controlCount: 3 },
-                { name: 'A09:2021-Logging Failures', controlCount: 3 },
-                { name: 'A10:2021-SSRF', controlCount: 3 },
-            ],
-            controls: generateOWASPControls(),
-        },
-        'pci-dss': {
-            version: '4.0',
-            categories: [
-                { name: 'Network Security', controlCount: 6 },
-                { name: 'Data Protection', controlCount: 5 },
-                { name: 'Vulnerability Management', controlCount: 4 },
-                { name: 'Access Control', controlCount: 6 },
-                { name: 'Monitoring and Testing', controlCount: 5 },
-                { name: 'Information Security Policy', controlCount: 4 },
-            ],
-            controls: generatePCIDSSControls(),
-        },
-        hipaa: {
-            version: '2013',
-            categories: [
-                { name: 'Administrative Safeguards', controlCount: 6 },
-                { name: 'Physical Safeguards', controlCount: 4 },
-                { name: 'Technical Safeguards', controlCount: 6 },
-                { name: 'Organizational Requirements', controlCount: 4 },
-            ],
-            controls: generateHIPAAControls(),
-        },
-    };
-    const config = frameworkConfigs[framework] || {
-        version: '1.0',
-        categories: [{ name: 'General Controls', controlCount: 10 }],
-        controls: generateGenericControls(framework),
-    };
-    // Assess controls
-    const controls = [];
-    const gaps = [];
-    const evidence = [];
-    let passed = 0;
-    let failed = 0;
-    for (const control of config.controls) {
-        const status = assessControl(control, auditType);
-        controls.push({
-            id: control.id,
-            framework,
-            category: control.category,
-            title: control.title,
-            description: `Assess ${control.title}`,
-            status: status.status,
-            severity: control.severity,
-            evidence: status.evidence,
-            findings: status.findings,
-            remediation: status.status !== 'pass' ? `Address ${control.title}` : undefined,
-        });
-        if (status.status === 'pass') {
-            passed++;
-        }
-        else if (status.status === 'fail') {
-            failed++;
-            gaps.push({
-                id: `gap-${control.id}`,
-                framework,
-                controlId: control.id,
-                title: `Non-compliance: ${control.title}`,
-                description: status.findings.join('; '),
-                severity: control.severity,
-                businessImpact: getBusinessImpact(control.severity),
-                remediationEffort: getRemediationEffort(control.severity),
-            });
-        }
-        evidence.push({
-            controlId: control.id,
-            type: 'automated',
-            description: `Evidence for ${control.title}`,
-            artifacts: status.evidence,
-            collectedAt: new Date().toISOString(),
-            validity: 'current',
-        });
-    }
-    // Calculate category results
-    const categoryResults = config.categories.map((cat) => {
-        const catControls = controls.filter((c) => c.category === cat.name);
-        const catPassed = catControls.filter((c) => c.status === 'pass').length;
-        const catFailed = catControls.filter((c) => c.status === 'fail').length;
-        const score = catControls.length > 0 ? (catPassed / catControls.length) * 100 : 100;
-        return {
-            name: cat.name,
-            score: Math.round(score),
-            status: score >= 90 ? 'pass' : score >= 70 ? 'partial' : 'fail',
-            controls: catControls.length,
-            findings: catFailed,
-        };
-    });
-    const totalControls = controls.length;
-    const score = totalControls > 0 ? (passed / totalControls) * 100 : 100;
-    return {
-        frameworkResult: {
-            framework,
-            version: config.version,
-            score: Math.round(score),
-            status: score >= 90 ? 'compliant' : score >= 70 ? 'partial' : 'non-compliant',
-            controlsPassed: passed,
-            controlsFailed: failed,
-            controlsNA: totalControls - passed - failed,
-            categories: categoryResults,
-            requiredActions: gaps.map((g) => g.title),
-        },
-        controls,
-        gaps,
-        evidence,
-    };
-}
-function generateOWASPControls() {
-    return [
-        { id: 'A01.1', title: 'Access Control Lists', category: 'A01:2021-Broken Access Control', severity: 'critical' },
-        { id: 'A01.2', title: 'Deny by Default', category: 'A01:2021-Broken Access Control', severity: 'high' },
-        { id: 'A02.1', title: 'Encryption at Rest', category: 'A02:2021-Cryptographic Failures', severity: 'high' },
-        { id: 'A02.2', title: 'Encryption in Transit', category: 'A02:2021-Cryptographic Failures', severity: 'high' },
-        { id: 'A03.1', title: 'Input Validation', category: 'A03:2021-Injection', severity: 'critical' },
-        { id: 'A03.2', title: 'Parameterized Queries', category: 'A03:2021-Injection', severity: 'critical' },
-        { id: 'A05.1', title: 'Security Headers', category: 'A05:2021-Security Misconfiguration', severity: 'medium' },
-        { id: 'A05.2', title: 'Error Handling', category: 'A05:2021-Security Misconfiguration', severity: 'medium' },
-        { id: 'A07.1', title: 'Password Policy', category: 'A07:2021-Authentication Failures', severity: 'high' },
-        { id: 'A07.2', title: 'Session Management', category: 'A07:2021-Authentication Failures', severity: 'high' },
-    ];
-}
-function generatePCIDSSControls() {
-    return [
-        { id: 'PCI-1.1', title: 'Network Segmentation', category: 'Network Security', severity: 'critical' },
-        { id: 'PCI-1.2', title: 'Firewall Configuration', category: 'Network Security', severity: 'high' },
-        { id: 'PCI-3.1', title: 'Data Encryption', category: 'Data Protection', severity: 'critical' },
-        { id: 'PCI-3.2', title: 'Key Management', category: 'Data Protection', severity: 'high' },
-        { id: 'PCI-6.1', title: 'Security Patches', category: 'Vulnerability Management', severity: 'high' },
-        { id: 'PCI-8.1', title: 'User Authentication', category: 'Access Control', severity: 'critical' },
-        { id: 'PCI-10.1', title: 'Audit Logging', category: 'Monitoring and Testing', severity: 'high' },
-    ];
-}
-function generateHIPAAControls() {
-    return [
-        { id: 'HIPAA-164.308a1', title: 'Risk Analysis', category: 'Administrative Safeguards', severity: 'critical' },
-        { id: 'HIPAA-164.308a3', title: 'Workforce Security', category: 'Administrative Safeguards', severity: 'high' },
-        { id: 'HIPAA-164.310a1', title: 'Facility Access', category: 'Physical Safeguards', severity: 'high' },
-        { id: 'HIPAA-164.312a1', title: 'Access Control', category: 'Technical Safeguards', severity: 'critical' },
-        { id: 'HIPAA-164.312e1', title: 'Transmission Security', category: 'Technical Safeguards', severity: 'critical' },
-    ];
-}
-function generateGenericControls(framework) {
-    return [
-        { id: `${framework}-1`, title: 'Access Control', category: 'General Controls', severity: 'high' },
-        { id: `${framework}-2`, title: 'Data Protection', category: 'General Controls', severity: 'high' },
-        { id: `${framework}-3`, title: 'Audit Logging', category: 'General Controls', severity: 'medium' },
-        { id: `${framework}-4`, title: 'Incident Response', category: 'General Controls', severity: 'medium' },
-        { id: `${framework}-5`, title: 'Configuration Management', category: 'General Controls', severity: 'medium' },
-    ];
-}
-function assessControl(control, auditType) {
-    // Simulate control assessment
-    const random = Math.random();
-    const isQuick = auditType === 'quick';
-    // Quick audits have higher pass rate (less thorough)
-    const passThreshold = isQuick ? 0.7 : 0.6;
-    const partialThreshold = isQuick ? 0.9 : 0.85;
-    if (random < passThreshold) {
-        return {
-            status: 'pass',
-            evidence: [`${control.id}-evidence.json`, `${control.id}-config.yaml`],
-            findings: [],
-        };
-    }
-    else if (random < partialThreshold) {
-        return {
-            status: 'partial',
-            evidence: [`${control.id}-evidence.json`],
-            findings: [`Partial implementation of ${control.title}`],
-        };
-    }
-    else {
-        return {
-            status: 'fail',
-            evidence: [],
-            findings: [`${control.title} not implemented or misconfigured`],
-        };
-    }
-}
-function getBusinessImpact(severity) {
-    const impacts = {
-        critical: 'Severe impact - potential data breach, regulatory fines, business disruption',
-        high: 'Significant impact - security vulnerability, compliance violation',
-        medium: 'Moderate impact - increased risk, potential security issues',
-        low: 'Minor impact - best practice deviation',
-    };
-    return impacts[severity] || 'Unknown impact';
-}
-function getRemediationEffort(severity) {
-    const efforts = {
-        critical: 'high',
-        high: 'medium',
-        medium: 'low',
-        low: 'low',
-    };
-    return efforts[severity] || 'medium';
-}
-function calculateAuditSummary(frameworkResults, gaps) {
-    const totalPassed = frameworkResults.reduce((sum, f) => sum + f.controlsPassed, 0);
-    const totalFailed = frameworkResults.reduce((sum, f) => sum + f.controlsFailed, 0);
-    const totalControls = totalPassed + totalFailed;
-    const avgScore = frameworkResults.length > 0
-        ? frameworkResults.reduce((sum, f) => sum + f.score, 0) / frameworkResults.length
-        : 0;
-    const criticalGaps = gaps.filter((g) => g.severity === 'critical').length;
-    const highGaps = gaps.filter((g) => g.severity === 'high').length;
-    return {
-        overallScore: Math.round(avgScore),
-        overallStatus: avgScore >= 90 ? 'compliant' : avgScore >= 70 ? 'partial' : 'non-compliant',
-        frameworkCount: frameworkResults.length,
-        controlsAssessed: totalControls,
-        controlsPassed: totalPassed,
-        controlsFailed: totalFailed,
-        criticalGaps,
-        riskLevel: criticalGaps > 0 ? 'critical' : highGaps > 2 ? 'high' : highGaps > 0 ? 'medium' : 'low',
-    };
-}
-function generateRemediationPlan(gaps) {
-    // Sort gaps by severity
-    const sortedGaps = [...gaps].sort((a, b) => {
-        const order = { critical: 0, high: 1, medium: 2, low: 3 };
-        return order[a.severity] - order[b.severity];
-    });
-    const priorityItems = sortedGaps.map((gap, index) => ({
-        priority: index + 1,
-        gap: gap.id,
-        action: `Remediate: ${gap.title}`,
-        owner: 'Security Team',
-        effort: gap.remediationEffort,
-        deadline: getDeadline(gap.severity),
-    }));
-    const timeline = [
-        {
-            phase: 'Immediate (0-2 weeks)',
-            duration: '2 weeks',
-            activities: sortedGaps.filter((g) => g.severity === 'critical').map((g) => g.title),
-            milestones: ['Critical gaps addressed'],
-        },
-        {
-            phase: 'Short-term (2-8 weeks)',
-            duration: '6 weeks',
-            activities: sortedGaps.filter((g) => g.severity === 'high').map((g) => g.title),
-            milestones: ['High severity gaps addressed', 'Initial compliance achieved'],
-        },
-        {
-            phase: 'Medium-term (2-3 months)',
-            duration: '4 weeks',
-            activities: sortedGaps.filter((g) => g.severity === 'medium' || g.severity === 'low').map((g) => g.title),
-            milestones: ['Full compliance achieved', 'Documentation complete'],
-        },
-    ];
-    return {
-        priority: priorityItems,
-        timeline,
-        estimatedEffort: `${Math.ceil(gaps.length * 2)} person-days`,
-        resourcesRequired: ['Security Engineer', 'DevOps Engineer', 'Compliance Officer'],
-    };
-}
-function getDeadline(severity) {
-    const deadlines = {
-        critical: 7,
-        high: 30,
-        medium: 60,
-        low: 90,
-    };
-    const days = deadlines[severity] || 30;
-    const date = new Date();
-    date.setDate(date.getDate() + days);
-    return date.toISOString().split('T')[0];
-}
-// Export tool definition for MCP registration
-export const toolDefinition = {
-    name: 'aqe/audit-compliance',
-    description: 'Comprehensive compliance auditing for security frameworks',
-    category: 'security-compliance',
-    version: '3.2.3',
-    inputSchema: AuditComplianceInputSchema,
-    handler,
-};
-export default toolDefinition;
-//# sourceMappingURL=audit-compliance.js.map