nsauditor-ai 0.2.10 → 0.2.11

package/README.md

@@ -17,7 +17,10 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.10 + Enterprise 0.19.4** (June 2026) — a **real CE feature** (MCP affordance II): the `scan_cloud` summary now surfaces actionable findings that used to be invisible. MEDIUM/LOW findings **roll up per provider by category** (`MEDIUM (8) sqs-age-alarm-missing ×2 · sns-failure-alarm-missing ×2 · …`, count-descending, no-silent-cap) — so a Desktop agent can no longer narrate "the alarm dimension came back clean" over live monitoring findings. And a NEW Enterprise-gated **`get_findings`** tool drills the most recent scan's per-provider cache (filter by provider/plugin/severity/category, paginate, FULL untruncated text) — keyed by a `scanId` the summary footer carries, gated *before* any cache read (a CE/Pro caller gets the same 🔒 denial as `scan_cloud`). Plus collector fixes (all-clauses gap companion · boundary-safe truncation · walkthrough-vs-couldn't-read `gapKind`) and a `scan_cloud` description that steers agents away from raw cloud-provider MCPs. Paired **EE 0.19.4** (unchanged — peer `>=0.2.8` already satisfied) + agent-skill 0.2.10 (documents `get_findings`). **EE 0.19.4 requires CE 0.2.8+.**
+<!-- DRAFT pending operator legal review (GDPR-cycle scope-doctrine copy). Not yet published. -->
+**Latest: CE 0.2.11 + Enterprise 0.20.0** (June 2026) — paired content bump for the Enterprise **GDPR Article 32 (Security of Processing)** cycle, the **seventh** compliance framework. The Enterprise engine now substrate-evidences **GDPR Article 32 infrastructure substrate** — Art. 32 only, **not** GDPR compliance (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can evidence). The CE-side change: the MCP `scan_cloud` tool description now lists GDPR Article 32 among the mapped frameworks, and the agent-skill teaches the 7th framework (scope doctrine · four-factor proportionality · the Art. 83(4) lower fine tier). No CE engine behavior change. Paired **EE 0.20.0** (the framework lives in the Enterprise engine; matrix 4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units) + agent-skill 0.2.11. **EE 0.20.0 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
+
+**Prior: CE 0.2.10 + Enterprise 0.19.4** — MCP affordance II: `scan_cloud` rolls up MEDIUM/LOW findings per provider by category + a NEW Enterprise-gated `get_findings` drill-down tool. See [CHANGELOG.md](./CHANGELOG.md).
 
 **Prior: CE 0.2.9 + Enterprise 0.19.4** — paired README-refresh pin for EE 0.19.4 "Routing-Integrity Hardening" (PCI matrix 20/8/39 → 19/9/39; no CE code change). See [CHANGELOG.md](./CHANGELOG.md).
 

package/mcp_server.mjs

@@ -26,7 +26,7 @@ import { buildRegionIntent } from './utils/region_intent.mjs';
 import { getTierFromEnv, loadLicense } from './utils/license.mjs';
 import { resolveCapabilities } from './utils/capabilities.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
-import { summarizeCloudFindings, renderCloudFindingsMarkdown, describeFinding } from './utils/cloud_finding_summary.mjs';
+import { summarizeCloudFindings, renderCloudFindingsMarkdown, describeFinding, RESOURCE_KEYS } from './utils/cloud_finding_summary.mjs';
 import { authorizeMcpServerStartup, getMcpAuthKeyAge, getRotationWarningDays, reportMcpAuthSource } from './utils/mcp_auth.mjs';
 
 const _require = createRequire(import.meta.url);
@@ -233,7 +233,7 @@ export const TOOLS = [
   {
     name: 'scan_cloud',
     description:
-      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, and CIS v8 controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
+      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -526,12 +526,12 @@ export async function handleGetFindings(args = {}) {
     if (args.severity && sev !== String(args.severity).toUpperCase()) continue;
     if (args.category && cat !== String(args.category)) continue;
     if (args.plugin && String(r?.id) !== String(args.plugin)) continue;
-    // Extract the resource identifier directly from the finding object (same key
-    // priority as describeFinding's RESOURCE_KEYS) — avoids split-after-truncation
-    // ambiguity when describeFinding truncates into the ' — ' separator.
-    const FINDING_RESOURCE_KEYS = ['userName','bucket','bucketName','function','functionName','table','tableName','instanceId','group','groupId','key','keyId','vault','vaultName','pipeline','topic','queue','projectId','domain','secretName','roleName','accountName','resource','resourceId','name','arn'];
+    // Extract the resource identifier directly from the finding object using the SAME
+    // key priority as describeFinding (the shared RESOURCE_KEYS imported from
+    // cloud_finding_summary.mjs) — avoids split-after-truncation ambiguity when
+    // describeFinding truncates into the ' — ' separator, and can never drift from it.
     let res = '';
-    for (const k of FINDING_RESOURCE_KEYS) { if (f && f[k]) { res = String(f[k]); break; } }
+    for (const k of RESOURCE_KEYS) { if (f && f[k]) { res = String(f[k]); break; } }
     rows.push({ plugin: String(r?.id ?? ''), severity: sev, category: cat,
       resource: res, region: f?.region || f?.details?.region || '',
       text: Array.isArray(f?.issues) ? f.issues.join(' · ') : String(f?.title || f?.classification || '') });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/utils/cloud_finding_summary.mjs

@@ -9,7 +9,10 @@ const RANK = { CRITICAL: 5, HIGH: 4, MEDIUM: 3, LOW: 2, INFO: 1, PASS: 0 };
 // Resource-identifying keys, most-specific first so a precise label wins over the
 // generic resource/name/arn fallbacks. Grounded in the REAL EE plugin emissions
 // (S3 1020 emits `bucket`, Key Vault `vault`, DynamoDB `table`, KMS `key`, …).
-const RESOURCE_KEYS = ['userName', 'bucket', 'bucketName', 'function', 'functionName', 'table', 'tableName', 'instanceId', 'group', 'groupId', 'key', 'keyId', 'vault', 'vaultName', 'pipeline', 'topic', 'queue', 'projectId', 'domain', 'secretName', 'roleName', 'accountName', 'resource', 'resourceId', 'name', 'arn'];
+// Exported as the SINGLE SOURCE OF TRUTH — get_findings (mcp_server.mjs) imports this
+// rather than re-declaring the list, so the two resource-extraction surfaces can never
+// drift on which key names a finding's resource.
+export const RESOURCE_KEYS = ['userName', 'bucket', 'bucketName', 'function', 'functionName', 'table', 'tableName', 'instanceId', 'group', 'groupId', 'key', 'keyId', 'vault', 'vaultName', 'pipeline', 'topic', 'queue', 'projectId', 'domain', 'secretName', 'roleName', 'accountName', 'resource', 'resourceId', 'name', 'arn'];
 const REASON_KEYS = ['classification', 'title', 'message', 'reason', 'finding', 'detail'];
 const UNKNOWN_PROVIDER = 'unknown';
 // Scan-coverage gap prose — an EXACT 1:1 mirror of the EE evidence-gap anchor