nsauditor-ai 0.1.93 → 0.1.95

package/README.md

@@ -17,8 +17,10 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.1.93 + Enterprise 0.16.2** (May 2026)
+**Latest: CE 0.1.94 + Enterprise 0.16.3** (May 2026)
 
+- 🛡️ **`scan_cloud` now surfaces cloud findings reliably** (CE 0.1.95 — paired EE 0.16.4) — *(false-clean fix)* the tool now builds a `findingsSummary` (per-provider severity counts + the CRITICAL/HIGH list) **directly from the scan results**, instead of the network-host concluder — which is built for port/service scans, doesn't understand cloud compliance findings, and silently **dropped** them. A scan could previously report `audited:true` with **0 findings over real CRITICALs**; now every finding is counted and every CRITICAL/HIGH is listed. Distinct from the 0.1.93 not-audited fold (caught by the `audit-cloud-plugin-false-negatives` review). Plugin count UNCHANGED at 28; all six matrices UNCHANGED.
+- ⚡ **`scan_cloud` runs cloud plugins in parallel** (CE 0.1.94 — paired EE 0.16.3) — the cloud-audit engine now runs the requested clouds' plugins **concurrently** (default up to 20 at once, 25s per-plugin timeout) so a full ~20-plugin AWS/GCP/Azure audit finishes within Claude Desktop's ~60s tool-call limit — previously the heaviest, most security-critical plugins (IAM, S3, EC2, Inspector/GuardDuty, decrypt-path) timed out at the 5s the budget forced under sequential execution. Tunable via `CLOUD_SCAN_CONCURRENCY` / `CLOUD_PLUGIN_TIMEOUT_MS`; the network `scan_host` path is unchanged; the anti-false-clean reporting is preserved. Plugin count UNCHANGED at 28; all six matrices UNCHANGED.
 - ☁️ **MCP `scan_cloud` tool: audit cloud accounts directly** (CE 0.1.93 — paired EE 0.16.2) — *(Enterprise)* a dedicated MCP tool so you can say *"Audit my AWS account"* or *"Audit my AWS and Azure accounts"* in Claude Desktop / Claude Code, with **no network host** — the server scopes the run to only the requested clouds' EE plugins. The MCP analog of the CLI `--host aws --plugins all` scoping. Enterprise-gated (`enterpriseMCP`) with plugin-layer defense-in-depth, and **anti-false-clean reporting** — a cloud is reported "audited" only if a plugin actually ran; a missing-credential / skipped cloud is surfaced as an explicit note + `audited:false` (R-HIGH caught + folded by the `audit-cloud-plugin-false-negatives` review). Plugin count UNCHANGED at 28; all six matrices UNCHANGED.
 - 🔌 **MCP `NSA_ENV_FILE`: per-environment `.env` for the MCP server** (CE 0.1.92 — paired EE 0.16.1) — the MCP analog of 0.16.0's CLI `--env`. Point the MCP server at a specific account/cloud by setting **`NSA_ENV_FILE`** to a dotenv path in your Claude Desktop / Claude Code config instead of inlining every credential; the server loads that environment's cloud credentials + `CLOUD_PROVIDER` at startup. Loaded **after** the MCP auth gate + license (scan-target vars only; the auth key + license are ignored if present in the file), **fail-fast** on a missing / INI / set-but-empty path, and treated as the **authoritative scan target** — leftover ambient provider credentials the file doesn't set are cleared, closing a false-clean (a partial file could otherwise silently scan a leftover account) caught + folded by the `audit-cloud-plugin-false-negatives` review. Plugin count UNCHANGED at 28; all six matrices UNCHANGED.
 - 🎯 **Per-account scanning: `--env` / `--aws-profile` + sentinel-host plugin scoping** (CE 0.1.91 — paired EE 0.16.0) — audit many cloud accounts one at a time without shell-export juggling. **`--env <path>`** loads a per-scan dotenv credentials file (override-on; fail-fast on a missing file; an INI/`~/.aws/credentials` file is detected and redirected to `--aws-profile`). **`--aws-profile <name>`** uses a named profile from the OS-default `~/.aws/credentials` (clears stale explicit keys, sets `AWS_SDK_LOAD_CONFIG=1`, implies `CLOUD_PROVIDER=aws`). On a cloud-sentinel host, **`--host aws|gcp|azure` + `--plugins all` auto-scopes** to only that cloud's plugins (other clouds + non-cloud plugins are skipped and logged); explicit `--plugins` lists are unaffected. A host↔`CLOUD_PROVIDER` conflict fails fast (no silent empty "clean" report), and a zero-match sentinel scope warns loudly. EE 0.16.0 adds a declarative `cloudProvider` field to all 27 cloud plugins. Plugin count UNCHANGED at 28; all six matrices UNCHANGED.
@@ -420,6 +422,13 @@ npx nsauditor-ai-mcp
 | `compliance_check` | Compliance mapping with gap analysis |
 | `export_report` | Generate formatted compliance report |
 
+> `scan_cloud` runs the requested clouds' plugins **concurrently** (default up to 20 at once, 25s per-plugin
+> timeout) so a full multi-service cloud audit completes within Claude Desktop's ~60s tool-call limit. Tune with
+> `CLOUD_SCAN_CONCURRENCY` (default 20) and `CLOUD_PLUGIN_TIMEOUT_MS` (default 25000) in the server env. The
+> network `PLUGIN_TIMEOUT_MS` still governs `scan_host` / network scans. Read the result's **`findingsSummary`**
+> (per-provider severity counts + a CRITICAL/HIGH list) for the findings; `audited:false` / `notes` / `pluginsRan:0`
+> still mean a cloud was NOT audited (never a clean pass). Pass `providers:["aws"]` to audit only the cloud named.
+
 Security: SSRF protection on all host inputs (blocks RFC 1918, loopback, fc00::/7, cloud metadata), port validation (1–65535), CPE format enforcement, dependency injection for test isolation. **Server-startup authentication is required** — see next section.
 
 ### Authentication (required)
@@ -503,6 +512,8 @@ The exact `NSA_MCP_AUTH_KEY` value to paste is printed by `nsauditor-ai mcp inst
 - `NSA_MCP_AUTH_KEY` — **required** (see Authentication section above)
 - `NSA_ALLOW_ALL_HOSTS=1` — required to scan private/RFC 1918 addresses (e.g., `192.168.x.x`)
 - `PLUGIN_TIMEOUT_MS=5000` — reduces per-plugin timeout to 5s so the full scan completes within Claude Desktop's 60s MCP limit
+- `CLOUD_SCAN_CONCURRENCY` — max cloud plugins run at once by `scan_cloud` (default 20).
+- `CLOUD_PLUGIN_TIMEOUT_MS` — per-plugin timeout for `scan_cloud` (default 25000; independent of the network `PLUGIN_TIMEOUT_MS`).
 - `AI_PROVIDER` and API key — optional, enables AI-powered analysis of scan results
 
 #### `NSA_ENV_FILE` — point the MCP server at an environment file

package/mcp_server.mjs

@@ -25,6 +25,7 @@ import {
 import { getTierFromEnv, loadLicense } from './utils/license.mjs';
 import { resolveCapabilities } from './utils/capabilities.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
+import { summarizeCloudFindings, renderCloudFindingsMarkdown } from './utils/cloud_finding_summary.mjs';
 import { authorizeMcpServerStartup, getMcpAuthKeyAge, getRotationWarningDays, reportMcpAuthSource } from './utils/mcp_auth.mjs';
 
 const _require = createRequire(import.meta.url);
@@ -196,7 +197,7 @@ const TOOLS = [
   {
     name: 'scan_cloud',
     description:
-      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. No network host required. Requires an Enterprise license. Use for "audit my AWS account" / "audit my AWS and Azure accounts".',
+      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -379,12 +380,17 @@ export async function handleScanCloud(args) {
     else process.env.CLOUD_PROVIDER = savedProvider;
   }
 
-  // Render a Markdown summary (best-effort, same as scan_host).
+  // Build the caller-visible findings surface DIRECTLY from the raw results — the
+  // network-host concluder (result_concluder.mjs) doesn't understand cloud
+  // compliance findings and silently drops them (the false-clean this fixes).
+  const providerOf = (id) => (pm.plugins || []).find((p) => String(p.id) === String(id))?.cloudProvider || null;
+  const findingsSummary = summarizeCloudFindings(output.results || [], providerOf);
+
+  // Render Markdown FROM the findings summary (NOT the host renderer, which is
+  // empty for a cloud conclusion). Best-effort.
   let markdown = null;
   try {
-    if (output.conclusion) {
-      markdown = buildMarkdownReport({ host: output.host, conclusion: output.conclusion, toolVersion: TOOL_VERSION });
-    }
+    markdown = renderCloudFindingsMarkdown(findingsSummary, providers);
   } catch { /* swallow — markdown is best-effort */ }
 
   // Anti-false-clean: a requested cloud is "audited" ONLY if >=1 of its plugins
@@ -412,7 +418,7 @@ export async function handleScanCloud(args) {
     providers,
     audited: auditedProviders.length > 0,
     auditedProviders,
-    conclusion: output.conclusion ?? null,
+    findingsSummary,
     manifest: output.manifest ?? [],
     pluginsRan,
     markdown,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/plugin_manager.mjs

@@ -21,6 +21,7 @@ import { discoverPlugins } from './utils/plugin_discovery.mjs';
 import { getTierFromEnv } from './utils/license.mjs';
 import { resolveCapabilities } from './utils/capabilities.mjs';
 import { scopeSelectionForHost, scopeSelectionForProviders } from './utils/sentinel_scope.mjs';
+import { mapLimit } from './utils/concurrency.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 
@@ -145,9 +146,15 @@ async function callPlugin(mod, host, ctx, priorOutputs = null, cliOpts = {}) {
     // Forward CLI-derived opts (ports, etc.) so plugins can honor flags like --ports.
     // CLI opts come last so they don't override critical orchestration fields like
     // `context` if the CLI ever accidentally collides on those names.
-    const pluginPromise = mod.run(host, port, { ...cliOpts, context: withBaseContext(ctx), ...extra });
-
-    const timeoutMs = PLUGIN_TIMEOUT_MS;
+    // Promise.resolve().then(...) so a plugin that throws SYNCHRONOUSLY (before its
+    // first await) becomes a rejected promise the race below catches, instead of
+    // propagating out of callPlugin and aborting the whole (sequential or parallel) batch.
+    const pluginPromise = Promise.resolve().then(() => mod.run(host, port, { ...cliOpts, context: withBaseContext(ctx), ...extra }));
+
+    // Honor a per-run timeout (cloud path) but clamp to a positive number; an
+    // undefined (network path) or non-positive value falls back to PLUGIN_TIMEOUT_MS.
+    const reqTimeout = Number(cliOpts && cliOpts.timeoutMs);
+    const timeoutMs = Number.isFinite(reqTimeout) && reqTimeout > 0 ? reqTimeout : PLUGIN_TIMEOUT_MS;
     let timer;
     const timeoutPromise = new Promise((_, reject) => {
       timer = setTimeout(() => reject(new Error(`Plugin "${mod.name}" timed out after ${timeoutMs}ms`)), timeoutMs);
@@ -853,6 +860,46 @@ export class PluginManager {
     };
   }
 
+  /**
+   * Concurrent executor for cloud plugins. Mirrors _runOrchestrated's per-plugin
+   * logic (requirements + capability skip checks, callPlugin, manifest status)
+   * but runs with bounded parallelism and a per-run timeout — cloud plugins are
+   * independent (no sequential context chain), so each gets its OWN base ctx and
+   * there is no shared-mutation race. Returns { results, manifest } in plugin order.
+   */
+  async _runCloudPluginsParallel(selected, host, opts = {}) {
+    const concurrency = Number(process.env.CLOUD_SCAN_CONCURRENCY) || 20;
+    const rawTimeout = Number(process.env.CLOUD_PLUGIN_TIMEOUT_MS);
+    const timeoutMs = Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : 25000;
+    const toRun = selected.filter((p) => !isConcluder(p));
+
+    const entries = await mapLimit(toRun, concurrency, async (mod) => {
+      try {
+        const ctx = withBaseContext({ host, hostUp: false, tcpOpen: new Set(), udpOpen: new Set() });
+        if (!shouldRunPlugin(mod, ctx)) {
+          return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status: 'skipped', reason: describeSkipReason(mod, ctx), duration_ms: 0 }, outputs: [] };
+        }
+        if (!this._hasCapabilities(mod, opts?.capabilities)) {
+          return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status: 'skipped', reason: `missing capabilities: ${(mod.requiredCapabilities || []).join(',')}`, duration_ms: 0 }, outputs: [] };
+        }
+        const startMs = Date.now();
+        const wrappedRuns = await callPlugin(mod, host, ctx, [], { ...opts, timeoutMs });
+        const duration_ms = Date.now() - startMs;
+        let status = 'ran';
+        let reason = null;
+        for (const w of wrappedRuns) {
+          if (w.result?.timedOut) { status = 'timeout'; reason = w.result.error || `timed out after ${timeoutMs}ms`; }
+          else if (w.result?.error && status !== 'timeout') { status = 'error'; reason = w.result.error; }
+        }
+        return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status, reason, duration_ms }, outputs: wrappedRuns };
+      } catch (err) {
+        return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status: 'error', reason: String(err?.message || err), duration_ms: 0 }, outputs: [] };
+      }
+    });
+
+    return { results: entries.flatMap((e) => e.outputs), manifest: entries.map((e) => e.manifest) };
+  }
+
   /**
    * Cloud-account audit: scope the plugin run to the union of the given cloud
    * providers (by each plugin's `cloudProvider` field), with no network host.
@@ -886,7 +933,7 @@ export class PluginManager {
                ai: null, ai_meta: null, ai_error: null, ai_out_path: null };
     }
 
-    const orch = await this._runOrchestrated(host, selected, opts);
+    const orch = await this._runCloudPluginsParallel(selected, host, opts);
     const conclusion = await this.runConcluder(orch.results);
 
     // Per-provider effectiveness from the manifest (ids match the selected set).

package/utils/cloud_finding_summary.mjs

@@ -0,0 +1,83 @@
+// utils/cloud_finding_summary.mjs
+//
+// Builds the caller-visible findings surface for scan_cloud DIRECTLY from the raw
+// plugin results — the network-host concluder (result_concluder.mjs) doesn't
+// understand cloud compliance findings and silently drops them. Robust across the
+// plugin-specific finding shapes (AWS bucket/userName/issues, GCP/Azure title).
+
+const RANK = { CRITICAL: 5, HIGH: 4, MEDIUM: 3, LOW: 2, INFO: 1, PASS: 0 };
+// Resource-identifying keys, most-specific first so a precise label wins over the
+// generic resource/name/arn fallbacks. Grounded in the REAL EE plugin emissions
+// (S3 1020 emits `bucket`, Key Vault `vault`, DynamoDB `table`, KMS `key`, …).
+const RESOURCE_KEYS = ['userName', 'bucket', 'bucketName', 'function', 'functionName', 'table', 'tableName', 'instanceId', 'group', 'groupId', 'key', 'keyId', 'vault', 'vaultName', 'pipeline', 'topic', 'queue', 'projectId', 'domain', 'secretName', 'roleName', 'accountName', 'resource', 'resourceId', 'name', 'arn'];
+const REASON_KEYS = ['classification', 'title', 'message', 'reason', 'finding', 'detail'];
+const UNKNOWN_PROVIDER = 'unknown';
+
+/** Robust one-line descriptor from any plugin finding shape. Never empty, never a raw object dump. */
+export function describeFinding(x) {
+  if (!x || typeof x !== 'object') return String(x ?? '').slice(0, 160);
+  let res = '';
+  for (const k of RESOURCE_KEYS) { if (x[k]) { res = String(x[k]); break; } }
+  let why = '';
+  if (Array.isArray(x.issues) && x.issues.length) why = String(x.issues[0]);
+  else for (const k of REASON_KEYS) { if (x[k]) { why = String(x[k]); break; } }
+  const s = ((res ? res + ' — ' : '') + why).trim();
+  if (s) return s.slice(0, 160);
+  const sev = String(x.severity || x.level || '').toUpperCase();
+  return sev ? sev + ' finding (no description)' : 'finding (no description)';
+}
+
+function findingsOf(r) {
+  const f = (r && (r.findings ?? r.result?.findings ?? r.result?.data)) ?? [];
+  return Array.isArray(f) ? f : [];
+}
+
+/**
+ * @param {Array} results              out.results (each {id, result:{findings|data}})
+ * @param {(id:any)=>string|null} providerOf  plugin id -> cloudProvider
+ * @param {number} [cap]               max CRITICAL/HIGH entries listed per provider
+ * @returns {Object} { [provider]: { counts:{SEV:n}, findings:[{severity,plugin,title}], truncated:boolean } }
+ */
+export function summarizeCloudFindings(results, providerOf, cap = Number(process.env.CLOUD_FINDINGS_CAP) || 60) {
+  const out = {};
+  for (const r of (Array.isArray(results) ? results : [])) {
+    const found = findingsOf(r);
+    if (!found.length) continue;
+    // Attribute to the plugin's cloud; an unresolved id that carries REAL findings is
+    // bucketed under 'unknown' rather than silently dropped (defense-in-depth against a
+    // future id collision / cloudProvider drift — never let a real finding vanish).
+    const prov = providerOf(r?.id ?? r?.result?.id) || UNKNOWN_PROVIDER;
+    const bucket = (out[prov] ||= { counts: {}, findings: [], truncated: false });
+    for (const x of found) {
+      const sev = String(x?.severity || x?.level || 'INFO').toUpperCase();
+      bucket.counts[sev] = (bucket.counts[sev] || 0) + 1;
+      if (sev === 'CRITICAL' || sev === 'HIGH') {
+        bucket.findings.push({ severity: sev, plugin: String(r?.id ?? ''), title: describeFinding(x) });
+      }
+    }
+  }
+  // Sort by severity (CRITICAL first) THEN truncate — so a CRITICAL is never evicted
+  // from the displayed list by a HIGH. Counts above are always complete (pre-cap).
+  for (const prov of Object.keys(out)) {
+    const b = out[prov];
+    b.findings.sort((a, c) => (RANK[c.severity] || 0) - (RANK[a.severity] || 0));
+    if (b.findings.length > cap) { b.truncated = true; b.findings = b.findings.slice(0, cap); }
+  }
+  return out;
+}
+
+/** Compact markdown from a summary. Named providers first, then any extras (e.g. 'unknown') so nothing is hidden. */
+export function renderCloudFindingsMarkdown(summary, providers) {
+  const named = providers && providers.length ? providers.slice() : [];
+  const order = [...named, ...Object.keys(summary).filter((p) => !named.includes(p))];
+  const lines = [];
+  for (const prov of order) {
+    const b = summary[prov]; if (!b) continue;
+    const c = b.counts || {};
+    lines.push(`## ${String(prov).toUpperCase()} — ${c.CRITICAL || 0} CRITICAL · ${c.HIGH || 0} HIGH · ${c.MEDIUM || 0} MEDIUM · ${c.LOW || 0} LOW · ${c.PASS || 0} PASS`);
+    for (const f of (b.findings || [])) lines.push(`- **[${f.severity}]** ${f.plugin}: ${f.title}`);
+    if (b.truncated) lines.push(`- _…CRITICAL/HIGH list truncated; see counts above for totals._`);
+    lines.push('');
+  }
+  return lines.join('\n').trim();
+}

package/utils/concurrency.mjs

@@ -0,0 +1,21 @@
+// utils/concurrency.mjs
+//
+// Minimal bounded-concurrency runner: run fn(item, index) over items with at
+// most `limit` in flight, returning results in input order. A thrown fn rejects
+// the whole call — callers that need per-item isolation should catch inside fn.
+
+export async function mapLimit(items, limit, fn) {
+  const list = Array.isArray(items) ? items : [];
+  const n = list.length;
+  const out = new Array(n);
+  const cap = Math.max(1, Math.min((limit | 0) || 1, n || 1));
+  let next = 0;
+  async function worker() {
+    while (next < n) {
+      const i = next++;
+      out[i] = await fn(list[i], i);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(cap, n) }, () => worker()));
+  return out;
+}