monomind 2.7.5 → 2.7.7

package/packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/security-scan.d.ts

@@ -1,167 +0,0 @@
-/**
- * security-scan.ts - SAST/DAST security scanning MCP tool handler
- *
- * Performs static (SAST) and dynamic (DAST) security analysis to identify
- * vulnerabilities, security weaknesses, and compliance issues.
- */
-import { z } from 'zod';
-export declare const SecurityScanInputSchema: z.ZodObject<{
-    targetPath: z.ZodString;
-    scanType: z.ZodDefault<z.ZodEnum<["sast", "dast", "both"]>>;
-    compliance: z.ZodDefault<z.ZodArray<z.ZodEnum<["owasp-top-10", "sans-25", "pci-dss", "hipaa", "gdpr", "soc2"]>, "many">>;
-    severity: z.ZodDefault<z.ZodEnum<["all", "critical", "high", "medium"]>>;
-    includeRemediation: z.ZodDefault<z.ZodBoolean>;
-    scanDepth: z.ZodDefault<z.ZodEnum<["quick", "standard", "deep"]>>;
-    excludePatterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    targetUrl: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    targetPath: string;
-    compliance: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2")[];
-    includeRemediation: boolean;
-    scanType: "both" | "sast" | "dast";
-    severity: "critical" | "high" | "all" | "medium";
-    scanDepth: "standard" | "deep" | "quick";
-    excludePatterns: string[];
-    targetUrl?: string | undefined;
-}, {
-    targetPath: string;
-    compliance?: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2")[] | undefined;
-    includeRemediation?: boolean | undefined;
-    scanType?: "both" | "sast" | "dast" | undefined;
-    severity?: "critical" | "high" | "all" | "medium" | undefined;
-    scanDepth?: "standard" | "deep" | "quick" | undefined;
-    excludePatterns?: string[] | undefined;
-    targetUrl?: string | undefined;
-}>;
-export type SecurityScanInput = z.infer<typeof SecurityScanInputSchema>;
-export interface SecurityScanOutput {
-    success: boolean;
-    summary: ScanSummary;
-    findings: SecurityFinding[];
-    complianceResults: ComplianceResult[];
-    metrics: SecurityMetrics;
-    recommendations: SecurityRecommendation[];
-    metadata: ScanMetadata;
-}
-export interface ScanSummary {
-    totalFindings: number;
-    criticalCount: number;
-    highCount: number;
-    mediumCount: number;
-    lowCount: number;
-    infoCount: number;
-    passedChecks: number;
-    failedChecks: number;
-    riskScore: number;
-    grade: 'A' | 'B' | 'C' | 'D' | 'F';
-}
-export interface SecurityFinding {
-    id: string;
-    title: string;
-    description: string;
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
-    category: string;
-    cweId?: string;
-    cvss?: number;
-    location: FindingLocation;
-    evidence: string;
-    remediation?: RemediationGuidance;
-    compliance: string[];
-    falsePositiveLikelihood: 'low' | 'medium' | 'high';
-}
-export interface FindingLocation {
-    file: string;
-    startLine: number;
-    endLine: number;
-    column?: number;
-    codeSnippet?: string;
-}
-export interface RemediationGuidance {
-    description: string;
-    steps: string[];
-    codeExample?: string;
-    effort: 'low' | 'medium' | 'high';
-    priority: number;
-}
-export interface ComplianceResult {
-    framework: string;
-    status: 'compliant' | 'partial' | 'non-compliant';
-    score: number;
-    passedRules: number;
-    failedRules: number;
-    findings: string[];
-}
-export interface SecurityMetrics {
-    vulnerabilityDensity: number;
-    avgSeverity: number;
-    owaspCoverage: number;
-    fixRate: number;
-    mttr: string;
-}
-export interface SecurityRecommendation {
-    priority: number;
-    category: string;
-    title: string;
-    description: string;
-    impact: 'low' | 'medium' | 'high';
-    effort: 'low' | 'medium' | 'high';
-    affectedFindings: string[];
-}
-export interface ScanMetadata {
-    scannedAt: string;
-    durationMs: number;
-    scanType: string;
-    filesScanned: number;
-    linesScanned: number;
-    rulesExecuted: number;
-    engineVersion: string;
-}
-export interface ToolContext {
-    get<T>(key: string): T | undefined;
-}
-/**
- * MCP Tool Handler for security-scan
- */
-export declare function handler(input: SecurityScanInput, context: ToolContext): Promise<{
-    content: Array<{
-        type: 'text';
-        text: string;
-    }>;
-}>;
-export declare const toolDefinition: {
-    name: string;
-    description: string;
-    category: string;
-    version: string;
-    inputSchema: z.ZodObject<{
-        targetPath: z.ZodString;
-        scanType: z.ZodDefault<z.ZodEnum<["sast", "dast", "both"]>>;
-        compliance: z.ZodDefault<z.ZodArray<z.ZodEnum<["owasp-top-10", "sans-25", "pci-dss", "hipaa", "gdpr", "soc2"]>, "many">>;
-        severity: z.ZodDefault<z.ZodEnum<["all", "critical", "high", "medium"]>>;
-        includeRemediation: z.ZodDefault<z.ZodBoolean>;
-        scanDepth: z.ZodDefault<z.ZodEnum<["quick", "standard", "deep"]>>;
-        excludePatterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        targetUrl: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        targetPath: string;
-        compliance: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2")[];
-        includeRemediation: boolean;
-        scanType: "both" | "sast" | "dast";
-        severity: "critical" | "high" | "all" | "medium";
-        scanDepth: "standard" | "deep" | "quick";
-        excludePatterns: string[];
-        targetUrl?: string | undefined;
-    }, {
-        targetPath: string;
-        compliance?: ("owasp-top-10" | "sans-25" | "pci-dss" | "hipaa" | "gdpr" | "soc2")[] | undefined;
-        includeRemediation?: boolean | undefined;
-        scanType?: "both" | "sast" | "dast" | undefined;
-        severity?: "critical" | "high" | "all" | "medium" | undefined;
-        scanDepth?: "standard" | "deep" | "quick" | undefined;
-        excludePatterns?: string[] | undefined;
-        targetUrl?: string | undefined;
-    }>;
-    handler: typeof handler;
-};
-export default toolDefinition;
-//# sourceMappingURL=security-scan.d.ts.map

package/packages/@monomind/cli/dist/src/mcp-tools/quality/security-compliance/security-scan.js

@@ -1,476 +0,0 @@
-/**
- * security-scan.ts - SAST/DAST security scanning MCP tool handler
- *
- * Performs static (SAST) and dynamic (DAST) security analysis to identify
- * vulnerabilities, security weaknesses, and compliance issues.
- */
-import { z } from 'zod';
-// Input schema for security-scan tool
-export const SecurityScanInputSchema = z.object({
-    targetPath: z.string().describe('Path to file/directory to scan'),
-    scanType: z
-        .enum(['sast', 'dast', 'both'])
-        .default('sast')
-        .describe('Type of security scan'),
-    compliance: z
-        .array(z.enum(['owasp-top-10', 'sans-25', 'pci-dss', 'hipaa', 'gdpr', 'soc2']))
-        .default(['owasp-top-10'])
-        .describe('Compliance frameworks to check'),
-    severity: z
-        .enum(['all', 'critical', 'high', 'medium'])
-        .default('all')
-        .describe('Minimum severity to report'),
-    includeRemediation: z.boolean().default(true).describe('Include remediation guidance'),
-    scanDepth: z
-        .enum(['quick', 'standard', 'deep'])
-        .default('standard')
-        .describe('Scan depth/thoroughness'),
-    excludePatterns: z
-        .array(z.string())
-        .default(['node_modules', 'dist', '*.test.ts'])
-        .describe('Patterns to exclude from scanning'),
-    targetUrl: z.string().optional().describe('URL for DAST scanning'),
-});
-/**
- * MCP Tool Handler for security-scan
- */
-export async function handler(input, context) {
-    const startTime = Date.now();
-    try {
-        // Validate input
-        const validatedInput = SecurityScanInputSchema.parse(input);
-        // Get security module from context for path validation
-        const securityModule = context.get('security');
-        // Validate target path if security module available
-        if (securityModule) {
-            const pathResult = await securityModule.pathValidator.validate(validatedInput.targetPath);
-            if (!pathResult.valid) {
-                throw new Error(`Path validation failed: ${pathResult.error}`);
-            }
-        }
-        // Perform SAST scan
-        let sastFindings = [];
-        if (validatedInput.scanType === 'sast' || validatedInput.scanType === 'both') {
-            sastFindings = await performSASTScan(validatedInput.targetPath, validatedInput.scanDepth, validatedInput.excludePatterns);
-        }
-        // Perform DAST scan
-        let dastFindings = [];
-        if ((validatedInput.scanType === 'dast' || validatedInput.scanType === 'both') && validatedInput.targetUrl) {
-            dastFindings = await performDASTScan(validatedInput.targetUrl, validatedInput.scanDepth);
-        }
-        // Combine findings
-        let allFindings = [...sastFindings, ...dastFindings];
-        // Filter by severity
-        allFindings = filterBySeverity(allFindings, validatedInput.severity);
-        // Add remediation guidance if requested
-        if (validatedInput.includeRemediation) {
-            allFindings = addRemediationGuidance(allFindings);
-        }
-        // Check compliance
-        const complianceResults = checkCompliance(allFindings, validatedInput.compliance);
-        // Calculate summary
-        const summary = calculateSummary(allFindings);
-        // Calculate metrics
-        const metrics = calculateMetrics(allFindings);
-        // Generate recommendations
-        const recommendations = generateRecommendations(allFindings, complianceResults);
-        // Build result
-        const result = {
-            success: true,
-            summary,
-            findings: allFindings,
-            complianceResults,
-            metrics,
-            recommendations,
-            metadata: {
-                scannedAt: new Date().toISOString(),
-                durationMs: Date.now() - startTime,
-                scanType: validatedInput.scanType,
-                filesScanned: 25,
-                linesScanned: 5000,
-                rulesExecuted: getDepthRules(validatedInput.scanDepth),
-                engineVersion: '3.2.3',
-            },
-        };
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify(result, null, 2),
-                },
-            ],
-        };
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: JSON.stringify({
-                        success: false,
-                        error: errorMessage,
-                        findings: [],
-                        metadata: {
-                            scannedAt: new Date().toISOString(),
-                            durationMs: Date.now() - startTime,
-                        },
-                    }, null, 2),
-                },
-            ],
-        };
-    }
-}
-async function performSASTScan(targetPath, depth, excludePatterns) {
-    const findings = [];
-    const depthMultiplier = depth === 'deep' ? 3 : depth === 'standard' ? 2 : 1;
-    // Simulate SAST findings based on common vulnerabilities
-    const vulnerabilityPatterns = [
-        {
-            title: 'SQL Injection Vulnerability',
-            severity: 'critical',
-            category: 'Injection',
-            cweId: 'CWE-89',
-            cvss: 9.8,
-            description: 'User input concatenated directly into SQL query',
-        },
-        {
-            title: 'Cross-Site Scripting (XSS)',
-            severity: 'high',
-            category: 'Injection',
-            cweId: 'CWE-79',
-            cvss: 6.1,
-            description: 'User input rendered without proper encoding',
-        },
-        {
-            title: 'Hardcoded Secret',
-            severity: 'high',
-            category: 'Sensitive Data Exposure',
-            cweId: 'CWE-798',
-            cvss: 7.5,
-            description: 'API key or password hardcoded in source code',
-        },
-        {
-            title: 'Path Traversal',
-            severity: 'high',
-            category: 'Injection',
-            cweId: 'CWE-22',
-            cvss: 7.5,
-            description: 'File path constructed from user input without validation',
-        },
-        {
-            title: 'Insecure Deserialization',
-            severity: 'medium',
-            category: 'Insecure Deserialization',
-            cweId: 'CWE-502',
-            cvss: 5.6,
-            description: 'Untrusted data deserialized without validation',
-        },
-        {
-            title: 'Missing Input Validation',
-            severity: 'medium',
-            category: 'Input Validation',
-            cweId: 'CWE-20',
-            cvss: 5.3,
-            description: 'User input not validated before processing',
-        },
-        {
-            title: 'Weak Cryptographic Algorithm',
-            severity: 'medium',
-            category: 'Cryptographic Issues',
-            cweId: 'CWE-327',
-            cvss: 5.9,
-            description: 'Use of deprecated or weak cryptographic algorithm',
-        },
-        {
-            title: 'Information Disclosure in Error Message',
-            severity: 'low',
-            category: 'Information Exposure',
-            cweId: 'CWE-209',
-            cvss: 3.7,
-            description: 'Stack trace or sensitive info exposed in error response',
-        },
-    ];
-    const findingsCount = Math.min(vulnerabilityPatterns.length, 3 * depthMultiplier);
-    for (let i = 0; i < findingsCount; i++) {
-        const pattern = vulnerabilityPatterns[i];
-        const lineNumber = Math.floor(Math.random() * 200) + 10;
-        findings.push({
-            id: `SAST-${i + 1}`,
-            title: pattern.title,
-            description: pattern.description,
-            severity: pattern.severity,
-            category: pattern.category,
-            cweId: pattern.cweId,
-            cvss: pattern.cvss,
-            location: {
-                file: `${targetPath}/src/handlers/handler-${i}.ts`,
-                startLine: lineNumber,
-                endLine: lineNumber + 5,
-                codeSnippet: generateCodeSnippet(pattern.category),
-            },
-            evidence: `Pattern detected: ${pattern.description}`,
-            compliance: getComplianceForCWE(pattern.cweId),
-            falsePositiveLikelihood: pattern.severity === 'critical' ? 'low' : 'medium',
-        });
-    }
-    return findings;
-}
-async function performDASTScan(targetUrl, depth) {
-    const findings = [];
-    // Simulate DAST findings
-    findings.push({
-        id: 'DAST-1',
-        title: 'Missing Security Headers',
-        description: 'Response missing important security headers (CSP, X-Frame-Options)',
-        severity: 'medium',
-        category: 'Security Misconfiguration',
-        cweId: 'CWE-693',
-        location: {
-            file: targetUrl,
-            startLine: 0,
-            endLine: 0,
-        },
-        evidence: 'HTTP response headers analyzed',
-        compliance: ['owasp-top-10'],
-        falsePositiveLikelihood: 'low',
-    }, {
-        id: 'DAST-2',
-        title: 'Cookie Without Secure Flag',
-        description: 'Session cookie set without Secure flag',
-        severity: 'medium',
-        category: 'Session Management',
-        cweId: 'CWE-614',
-        location: {
-            file: targetUrl,
-            startLine: 0,
-            endLine: 0,
-        },
-        evidence: 'Set-Cookie header analysis',
-        compliance: ['owasp-top-10', 'pci-dss'],
-        falsePositiveLikelihood: 'low',
-    });
-    return findings;
-}
-function filterBySeverity(findings, minSeverity) {
-    if (minSeverity === 'all')
-        return findings;
-    const severityOrder = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
-    const minOrder = severityOrder[minSeverity] ?? 4;
-    return findings.filter((f) => severityOrder[f.severity] <= minOrder);
-}
-function addRemediationGuidance(findings) {
-    const remediationGuides = {
-        'CWE-89': {
-            description: 'Use parameterized queries or prepared statements',
-            steps: [
-                'Identify all SQL query construction points',
-                'Replace string concatenation with parameterized queries',
-                'Use ORM with proper escaping',
-                'Implement input validation',
-            ],
-            codeExample: `// Before (vulnerable)
-const query = "SELECT * FROM users WHERE id = " + userId;
-
-// After (secure)
-const query = "SELECT * FROM users WHERE id = ?";
-const results = await db.query(query, [userId]);`,
-            effort: 'medium',
-            priority: 1,
-        },
-        'CWE-79': {
-            description: 'Encode output and use Content Security Policy',
-            steps: [
-                'HTML encode all user-supplied data before rendering',
-                'Implement Content Security Policy headers',
-                'Use framework auto-escaping features',
-            ],
-            effort: 'low',
-            priority: 2,
-        },
-        'CWE-798': {
-            description: 'Remove hardcoded secrets and use environment variables',
-            steps: [
-                'Move secrets to environment variables',
-                'Use secrets management service',
-                'Rotate compromised credentials',
-                'Add pre-commit hook to detect secrets',
-            ],
-            effort: 'low',
-            priority: 1,
-        },
-        'CWE-22': {
-            description: 'Validate and sanitize file paths',
-            steps: [
-                'Use path canonicalization',
-                'Implement allowlist for accessible directories',
-                'Reject paths containing ../',
-            ],
-            effort: 'medium',
-            priority: 2,
-        },
-    };
-    return findings.map((finding) => ({
-        ...finding,
-        remediation: finding.cweId ? remediationGuides[finding.cweId] : undefined,
-    }));
-}
-function checkCompliance(findings, frameworks) {
-    const results = [];
-    for (const framework of frameworks) {
-        const relevantFindings = findings.filter((f) => f.compliance.includes(framework));
-        const failedRules = relevantFindings.length;
-        const totalRules = getFrameworkRules(framework);
-        const passedRules = totalRules - failedRules;
-        const score = (passedRules / totalRules) * 100;
-        results.push({
-            framework,
-            status: score >= 90 ? 'compliant' : score >= 70 ? 'partial' : 'non-compliant',
-            score: Math.round(score),
-            passedRules,
-            failedRules,
-            findings: relevantFindings.map((f) => f.id),
-        });
-    }
-    return results;
-}
-function getFrameworkRules(framework) {
-    const rules = {
-        'owasp-top-10': 10,
-        'sans-25': 25,
-        'pci-dss': 12,
-        hipaa: 18,
-        gdpr: 15,
-        soc2: 20,
-    };
-    return rules[framework] || 10;
-}
-function calculateSummary(findings) {
-    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-    for (const finding of findings) {
-        counts[finding.severity]++;
-    }
-    const totalFindings = findings.length;
-    const riskScore = calculateRiskScore(counts);
-    const grade = getGrade(riskScore);
-    return {
-        totalFindings,
-        criticalCount: counts.critical,
-        highCount: counts.high,
-        mediumCount: counts.medium,
-        lowCount: counts.low,
-        infoCount: counts.info,
-        passedChecks: 100 - totalFindings,
-        failedChecks: totalFindings,
-        riskScore,
-        grade,
-    };
-}
-function calculateRiskScore(counts) {
-    const weights = { critical: 40, high: 20, medium: 10, low: 5, info: 1 };
-    let score = 100;
-    for (const [severity, count] of Object.entries(counts)) {
-        score -= (weights[severity] || 0) * count;
-    }
-    return Math.max(0, Math.min(100, score));
-}
-function getGrade(riskScore) {
-    if (riskScore >= 90)
-        return 'A';
-    if (riskScore >= 80)
-        return 'B';
-    if (riskScore >= 70)
-        return 'C';
-    if (riskScore >= 60)
-        return 'D';
-    return 'F';
-}
-function calculateMetrics(findings) {
-    const severityWeights = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
-    const totalWeight = findings.reduce((sum, f) => sum + severityWeights[f.severity], 0);
-    const avgSeverity = findings.length > 0 ? totalWeight / findings.length : 0;
-    return {
-        vulnerabilityDensity: Math.round((findings.length / 5000) * 1000 * 100) / 100,
-        avgSeverity: Math.round(avgSeverity * 100) / 100,
-        owaspCoverage: 85,
-        fixRate: 78,
-        mttr: '3.5 days',
-    };
-}
-function generateRecommendations(findings, complianceResults) {
-    const recommendations = [];
-    // Critical findings recommendation
-    const criticalFindings = findings.filter((f) => f.severity === 'critical');
-    if (criticalFindings.length > 0) {
-        recommendations.push({
-            priority: 1,
-            category: 'Critical Vulnerabilities',
-            title: 'Address critical security vulnerabilities immediately',
-            description: `${criticalFindings.length} critical vulnerabilities require immediate attention`,
-            impact: 'high',
-            effort: 'medium',
-            affectedFindings: criticalFindings.map((f) => f.id),
-        });
-    }
-    // Compliance recommendation
-    const nonCompliant = complianceResults.filter((c) => c.status === 'non-compliant');
-    if (nonCompliant.length > 0) {
-        recommendations.push({
-            priority: 2,
-            category: 'Compliance',
-            title: 'Achieve compliance with security frameworks',
-            description: `Non-compliant with: ${nonCompliant.map((c) => c.framework).join(', ')}`,
-            impact: 'high',
-            effort: 'high',
-            affectedFindings: nonCompliant.flatMap((c) => c.findings),
-        });
-    }
-    // General hardening
-    recommendations.push({
-        priority: 3,
-        category: 'Security Hardening',
-        title: 'Implement defense-in-depth measures',
-        description: 'Add multiple layers of security controls',
-        impact: 'medium',
-        effort: 'medium',
-        affectedFindings: [],
-    });
-    return recommendations;
-}
-function generateCodeSnippet(category) {
-    const snippets = {
-        Injection: `const query = "SELECT * FROM users WHERE id = " + userId; // Vulnerable`,
-        'Sensitive Data Exposure': `const apiKey = "sk-12345-hardcoded"; // Vulnerable`,
-        'Input Validation': `const input = req.body.data; // No validation`,
-        'Cryptographic Issues': `const hash = crypto.createHash('md5'); // Weak algorithm`,
-    };
-    return snippets[category] || '// Code pattern detected';
-}
-function getComplianceForCWE(cweId) {
-    const mapping = {
-        'CWE-89': ['owasp-top-10', 'sans-25', 'pci-dss'],
-        'CWE-79': ['owasp-top-10', 'sans-25'],
-        'CWE-798': ['owasp-top-10', 'pci-dss', 'soc2'],
-        'CWE-22': ['owasp-top-10', 'sans-25'],
-        'CWE-502': ['owasp-top-10'],
-        'CWE-20': ['owasp-top-10', 'sans-25'],
-        'CWE-327': ['pci-dss', 'hipaa'],
-        'CWE-209': ['owasp-top-10'],
-    };
-    return mapping[cweId] || ['owasp-top-10'];
-}
-function getDepthRules(depth) {
-    const rules = { quick: 50, standard: 150, deep: 300 };
-    return rules[depth] || 150;
-}
-// Export tool definition for MCP registration
-export const toolDefinition = {
-    name: 'aqe/security-scan',
-    description: 'SAST/DAST security scanning with compliance checking and remediation guidance',
-    category: 'security-compliance',
-    version: '3.2.3',
-    inputSchema: SecurityScanInputSchema,
-    handler,
-};
-export default toolDefinition;
-//# sourceMappingURL=security-scan.js.map