nsauditor-ai 0.2.10 → 0.2.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -11
- package/mcp_server.mjs +7 -7
- package/package.json +1 -1
- package/utils/cloud_finding_summary.mjs +4 -1
package/README.md
CHANGED
|
@@ -17,7 +17,11 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
|
|
|
17
17
|
|
|
18
18
|
## What's New
|
|
19
19
|
|
|
20
|
-
**Latest: CE 0.2.
|
|
20
|
+
**Latest: CE 0.2.12 + Enterprise 0.30.0** (June 2026) — paired content bump for the Enterprise **"AWS + Azure false-negative depth-pass + cross-source/cross-vector compliance-mapping parity"** cycle. The Enterprise engine closes a wave of cloud-misconfiguration false-negatives (S3 access-point public-exposure · resource-policy effective-exposure on Lambda/DynamoDB/SQS-SNS/VPC-endpoints/Secrets/API-Gateway · EC2-SG public-vs-private-CIDR + split-range · KMS effective-decrypt + cross-account key-policy · IAM ListUsers truncation · Azure storage/NSG/Key-Vault/cloud-scanner class-O fail-opens) and makes the compliance verdict **consistent across all seven frameworks** (architecturally-identical confidentiality / least-privilege exposures now route to the same controls — incl. a public application entry-point now appearing on a NIST CSF **PR.AA-05** least-privilege report). **No new framework, no new plugins (still 28), no coverage-matrix changes** — a detection-depth + mapping-correctness release. **No CE engine behavior change** (the depth/parity lives in the Enterprise engine). Paired **EE 0.30.0** + agent-skill 0.2.12. **EE 0.30.0 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
|
|
21
|
+
|
|
22
|
+
**Prior: CE 0.2.11 + Enterprise 0.20.0** — paired content bump for the Enterprise **GDPR Article 32 (Security of Processing)** cycle, the seventh compliance framework (Art. 32 infrastructure substrate only, not GDPR compliance; the MCP `scan_cloud` description lists GDPR Art. 32; the agent-skill teaches it; no CE engine change). See [CHANGELOG.md](./CHANGELOG.md).
|
|
23
|
+
|
|
24
|
+
**Prior: CE 0.2.10 + Enterprise 0.19.4** — MCP affordance II: `scan_cloud` rolls up MEDIUM/LOW findings per provider by category + a NEW Enterprise-gated `get_findings` drill-down tool. See [CHANGELOG.md](./CHANGELOG.md).
|
|
21
25
|
|
|
22
26
|
**Prior: CE 0.2.9 + Enterprise 0.19.4** — paired README-refresh pin for EE 0.19.4 "Routing-Integrity Hardening" (PCI matrix 20/8/39 → 19/9/39; no CE code change). See [CHANGELOG.md](./CHANGELOG.md).
|
|
23
27
|
|
|
@@ -48,22 +52,23 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
|
|
|
48
52
|
|
|
49
53
|
### Why upgrade to Enterprise?
|
|
50
54
|
|
|
51
|
-
If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001,
|
|
55
|
+
If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, or GDPR Article 32 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
|
|
52
56
|
|
|
53
57
|
- ☁️ **28 cloud plugins** across AWS / Azure / GCP — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
|
|
54
|
-
- 📋 **
|
|
58
|
+
- 📋 **7 compliance frameworks shipped** — generate any combination from a single scan:
|
|
55
59
|
- **SOC 2** (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
|
|
56
60
|
- **HIPAA Security Rule §164.312** — 7 covered + 3 partial Technical Safeguards; **Zero BAA required** (ePHI never leaves your infrastructure)
|
|
57
61
|
- **NIST CSF 2.0 Core** (NIST CSWP 29, Feb 2024) — 13 covered + 10 partial Subcategories across 106 of CSF 2.0's 107 Subcategories; Subcategory-level mapping (auditor-canonical, not high-level Function/Category claims)
|
|
58
|
-
- **PCI DSS v4.0.1** (PCI SSC, June 2024 errata; v3.2.1 retired March 31, 2024) — **
|
|
62
|
+
- **PCI DSS v4.0.1** (PCI SSC, June 2024 errata; v3.2.1 retired March 31, 2024) — **19 covered + 9 partial + 39 OOS sub-requirements across 67 of ~250 (MVP-67)**; sub-requirement-level mapping for QSA Report on Compliance workflow; Defined-vs-Customized Approach discipline per Appendix E (15 Defined-only sub-requirements enforced at schema layer); CHD Scope operator-attested via CDE Data Flow Diagram per Req 1.2.4; Card-brand AOC enforcement priority view (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC)
|
|
59
63
|
- **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
|
|
60
|
-
- **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered +
|
|
64
|
+
- **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 22 partial + 114 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
|
|
65
|
+
- **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
|
|
61
66
|
- 🔐 **Cryptographically signed evidence** — SHA-256 chain-of-custody + RFC 3161 trusted timestamps + Ed25519 suppression signing. Non-repudiation, not just integrity. Auditors can verify offline.
|
|
62
67
|
- 🏛️ **Zero Data Exfiltration architecture** — your scan data never leaves your infrastructure. Air-gapped deployment supported. AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
|
|
63
68
|
- 🔗 **Native GRC platform integration** — push evidence directly to **Vanta** (live; Drata + Secureframe planned). Idempotent retries, per-tenant token rotation, rate-limit handling, signed-envelope round-trip integrity.
|
|
64
69
|
- 🗄️ **WORM evidence storage** — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
|
|
65
70
|
- 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
|
|
66
|
-
- 🎯 **
|
|
71
|
+
- 🎯 **11 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)
|
|
67
72
|
|
|
68
73
|
→ **[See sample EE scan output](https://www.nsauditor.com/ai/docs/sample-scan/)** — full evidence pack against synthetic Acme Corp AWS account (no signup required)
|
|
69
74
|
→ **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/pricing/)** — $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.
|
|
@@ -85,13 +90,14 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, or CI
|
|
|
85
90
|
| **Enterprise — cloud scanning** | | | |
|
|
86
91
|
| 28 cloud plugins (AWS / Azure / GCP) | — | — | ✅ |
|
|
87
92
|
| Zero Trust assessment | — | — | ✅ |
|
|
88
|
-
| **Enterprise — compliance (
|
|
93
|
+
| **Enterprise — compliance (7 frameworks)** | | | |
|
|
89
94
|
| SOC 2 (AICPA TSC 2017) — 10 covered + 4 partial controls | — | — | ✅ |
|
|
90
95
|
| HIPAA Security Rule §164.312 — Zero BAA required | — | — | ✅ |
|
|
91
96
|
| NIST CSF 2.0 Core — Subcategory-level mapping (106 of 107 Subcategories) | — | — | ✅ |
|
|
92
97
|
| PCI DSS v4.0.1 — Sub-requirement-level mapping for QSA RoC (MVP-67) | — | — | ✅ |
|
|
93
98
|
| ISO/IEC 27001:2022 — per-Annex-A-code mapping + SoA discipline (93 Annex A controls) | — | — | ✅ |
|
|
94
|
-
|
|
|
99
|
+
| CIS Critical Security Controls v8 — per-Safeguard mapping + IG-cumulative discipline (153 Safeguards / 18 Controls) | — | — | ✅ |
|
|
100
|
+
| **GDPR Article 32 (Security of Processing)** — Art. 32 infrastructure substrate (4 covered + 5 partial + 2 OOS / 11 sub-measure units); **not GDPR compliance** · Art. 83(4) lower fine tier (NEW) | — | — | ✅ |
|
|
95
101
|
| Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8` from one scan | — | — | ✅ |
|
|
96
102
|
| **Enterprise — auditor-grade evidence** | | | |
|
|
97
103
|
| Signed evidence packs (SHA-256 + RFC 3161 timestamps) | — | — | ✅ |
|
|
@@ -262,9 +268,10 @@ Results land in `./out/<host>_<timestamp>/`:
|
|
|
262
268
|
| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), chain-of-custody, RFC 3161 timestamps, suppression workflow with Ed25519 signing. |
|
|
263
269
|
| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same institutional-grade evidence infrastructure as SOC 2 (chain-of-custody, RFC 3161 timestamps, Ed25519 suppression signing). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
|
|
264
270
|
| — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |
|
|
265
|
-
| — | **PCI DSS v4.0.1 Compliance Engine (NEW EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **
|
|
271
|
+
| — | **PCI DSS v4.0.1 Compliance Engine (NEW EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **19 covered + 9 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67 density)** (Req 7.2.2 down-rated covered→partial in EE 0.19.4 — access-by-job-classification is process/HR-gated). Req 12 Information Security Program OOS-by-design entirely. Req 5 anti-malware + Req 9 physical OOS-entirely. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **4 load-bearing schema enrichments** per control: `controlType` + `approachEligibility` + `cloudProviderAttestation` (AWS / Azure / GCP currently-named AOCs) + `cdeScope`. CAO MVP-deferred to EE 0.11.1. Use `--compliance pci-dss` or `--compliance soc2,hipaa,nist-csf,pci-dss` for quad-framework reports from a single scan. |
|
|
266
272
|
| — | **ISO/IEC 27001:2022 Compliance Engine (EE 0.12.0)** | Enterprise | ISO/IEC 27001:2022 (ISO + IEC, October 2022; 2013 edition retired October 31, 2025) Annex A mapping at the auditor-canonical per-Annex-A-code level for ISO/IEC 17021-1 certification body assessors — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe across 4 themes: A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). **Statement of Applicability per Clause 6.1.3.d discipline** — engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 OR management review per Clause 9.3 = auto-fail Stage 2). 11 NEW 2022 controls + 5-attribute taxonomy (cybersecurityConcepts 5 categories, NOT 6 like NIST CSF) + 2013-to-2022 transition discipline + Cloud-Provider Certificate Inheritance Matrix. Use `--compliance iso-27001` or any combination for multi-framework reports from a single scan. |
|
|
267
|
-
| — | **CIS Critical Security Controls v8 Compliance Engine (NEW EE 0.13.0)** | Enterprise | CIS Controls v8 (Center for Internet Security, May 2021; v8.1 errata June 2024) mapping at the per-Safeguard level (the atomic, attestable unit; coverage claimed at the SAFEGUARD level, never the Control level) — **17 covered +
|
|
273
|
+
| — | **CIS Critical Security Controls v8 Compliance Engine (NEW EE 0.13.0)** | Enterprise | CIS Controls v8 (Center for Internet Security, May 2021; v8.1 errata June 2024) mapping at the per-Safeguard level (the atomic, attestable unit; coverage claimed at the SAFEGUARD level, never the Control level) — **17 covered + 22 partial + 114 OOS across 153 Safeguards / 18 Controls**. **Implementation Group cumulative discipline** — IG1=56 (cyber-insurance baseline; ~50-70% of mid-market policies require IG1 attestation), IG2 cumulative=130, IG3 cumulative=153; smallest-IG-membership tagging (NEVER report IG2 as 74-of-74 in isolation). **No-certification-body attestation discipline** — engine output is INPUT to CSAT / CIS-CAT Pro self-attestation OR a SOC 2 auditor cross-validating CIS scope, never "CIS certified." Cloud Companion Guide v8 shared-responsibility-model boundary + CIS-Hardened-Image substrate-evidence credit (Safeguards 4.1/4.2/4.6) + 5 Security Functions (NOT 6 — no Govern) + 6 Asset Types + MS-ISAC/EI-ISAC/H-ISAC sector baselines + v7.1-to-v8 cross-reference. Use `--compliance cis-v8` or `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr` for hepta-framework reports from a single scan. |
|
|
274
|
+
| — | **GDPR Article 32 Compliance Engine (NEW EE 0.20.0)** | Enterprise | **GDPR Article 32 (Security of Processing)** infrastructure substrate (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units** (the 7th framework). **This is GDPR Article 32 infrastructure substrate ONLY — NOT GDPR compliance.** GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article whose evidence is technical infrastructure state, so the rest of GDPR (lawful basis, consent, DSARs, records of processing, DPIAs, transfers) is operator-side and out of scope by design. **Four-factor proportionality** — Art. 32 measures are "appropriate to the risk" taking into account state-of-the-art / cost / nature-scope-context-purposes / risk; nothing is an absolute pass/fail, the engine produces substrate *for* the operator's determination. **Personal-data-scope attestation** — the scanner reads configuration, not data classification; a finding is an Art. 32 concern only if the resource processes personal data (pair with your Art. 30 records of processing). Controller-vs-processor role applicability + Art. 28 processor agreements. **Art. 83(4) lower fine tier** — Art. 32 infringements cap at €10M or 2% of turnover, NOT the €20M / 4% Art. 83(5) headline tier (which is for the basic principles + data-subject rights). Art. 32(3)/Art. 42 cloud-provider certification-inheritance (ISO 27001 / SOC 2 / C5 / EU Cloud CoC adherence as an element of demonstrable compliance, not a substitute). Use `--compliance gdpr` or any combination for multi-framework reports from a single scan. |
|
|
268
275
|
| — | SLA & MTTR Tracking | Enterprise | Per-severity SLA targets, compensating-control flow, finding lifecycle, Type II rolling-quarter cadence. |
|
|
269
276
|
| — | Recurring-Scan Attestation | Enterprise | Multi-scan chronological matrix, cadence gap detection, scope-drift surface (CC8.1). |
|
|
270
277
|
| — | GRC Platform Connector | Enterprise | Native API push to Vanta / Drata / Secureframe with retry/backoff, idempotency, rate-limit handling, per-tenant token rotation. |
|
|
@@ -650,7 +657,7 @@ nsauditor-ai --version (or -v, or `version`)
|
|
|
650
657
|
| `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
|
|
651
658
|
| `--webhook-url <url>` | Webhook URL for delta alerts | — |
|
|
652
659
|
| `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
|
|
653
|
-
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8`). **Enterprise license required.** Supported frameworks as of EE 0.
|
|
660
|
+
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, `gdpr`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr`). **Enterprise license required.** Supported frameworks as of EE 0.20.0: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022) + `cis-v8` (CIS Critical Security Controls v8, CIS May 2021 / v8.1 errata June 2024) + `gdpr` (GDPR Article 32 / Security of Processing, Regulation (EU) 2016/679 — Art. 32 infrastructure substrate, **not** GDPR compliance). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
|
|
654
661
|
| `--compliance-scope <path>` | Optional JSON file describing the assessment scope (passed to the compliance engine for cover-page attestation) | — |
|
|
655
662
|
| `--help`, `-h` | Print usage block (subcommands, flags, env vars, examples) and exit 0 | — |
|
|
656
663
|
| `--version`, `-v` | Print `nsauditor-ai <version>` and exit 0 | — |
|
package/mcp_server.mjs
CHANGED
|
@@ -26,7 +26,7 @@ import { buildRegionIntent } from './utils/region_intent.mjs';
|
|
|
26
26
|
import { getTierFromEnv, loadLicense } from './utils/license.mjs';
|
|
27
27
|
import { resolveCapabilities } from './utils/capabilities.mjs';
|
|
28
28
|
import { buildMarkdownReport } from './utils/report_md.mjs';
|
|
29
|
-
import { summarizeCloudFindings, renderCloudFindingsMarkdown, describeFinding } from './utils/cloud_finding_summary.mjs';
|
|
29
|
+
import { summarizeCloudFindings, renderCloudFindingsMarkdown, describeFinding, RESOURCE_KEYS } from './utils/cloud_finding_summary.mjs';
|
|
30
30
|
import { authorizeMcpServerStartup, getMcpAuthKeyAge, getRotationWarningDays, reportMcpAuthSource } from './utils/mcp_auth.mjs';
|
|
31
31
|
|
|
32
32
|
const _require = createRequire(import.meta.url);
|
|
@@ -233,7 +233,7 @@ export const TOOLS = [
|
|
|
233
233
|
{
|
|
234
234
|
name: 'scan_cloud',
|
|
235
235
|
description:
|
|
236
|
-
'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001,
|
|
236
|
+
'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
|
|
237
237
|
inputSchema: {
|
|
238
238
|
type: 'object',
|
|
239
239
|
properties: {
|
|
@@ -526,12 +526,12 @@ export async function handleGetFindings(args = {}) {
|
|
|
526
526
|
if (args.severity && sev !== String(args.severity).toUpperCase()) continue;
|
|
527
527
|
if (args.category && cat !== String(args.category)) continue;
|
|
528
528
|
if (args.plugin && String(r?.id) !== String(args.plugin)) continue;
|
|
529
|
-
// Extract the resource identifier directly from the finding object
|
|
530
|
-
// priority as describeFinding
|
|
531
|
-
//
|
|
532
|
-
|
|
529
|
+
// Extract the resource identifier directly from the finding object using the SAME
|
|
530
|
+
// key priority as describeFinding (the shared RESOURCE_KEYS imported from
|
|
531
|
+
// cloud_finding_summary.mjs) — avoids split-after-truncation ambiguity when
|
|
532
|
+
// describeFinding truncates into the ' — ' separator, and can never drift from it.
|
|
533
533
|
let res = '';
|
|
534
|
-
for (const k of
|
|
534
|
+
for (const k of RESOURCE_KEYS) { if (f && f[k]) { res = String(f[k]); break; } }
|
|
535
535
|
rows.push({ plugin: String(r?.id ?? ''), severity: sev, category: cat,
|
|
536
536
|
resource: res, region: f?.region || f?.details?.region || '',
|
|
537
537
|
text: Array.isArray(f?.issues) ? f.issues.join(' · ') : String(f?.title || f?.classification || '') });
|
package/package.json
CHANGED
|
@@ -9,7 +9,10 @@ const RANK = { CRITICAL: 5, HIGH: 4, MEDIUM: 3, LOW: 2, INFO: 1, PASS: 0 };
|
|
|
9
9
|
// Resource-identifying keys, most-specific first so a precise label wins over the
|
|
10
10
|
// generic resource/name/arn fallbacks. Grounded in the REAL EE plugin emissions
|
|
11
11
|
// (S3 1020 emits `bucket`, Key Vault `vault`, DynamoDB `table`, KMS `key`, …).
|
|
12
|
-
|
|
12
|
+
// Exported as the SINGLE SOURCE OF TRUTH — get_findings (mcp_server.mjs) imports this
|
|
13
|
+
// rather than re-declaring the list, so the two resource-extraction surfaces can never
|
|
14
|
+
// drift on which key names a finding's resource.
|
|
15
|
+
export const RESOURCE_KEYS = ['userName', 'bucket', 'bucketName', 'function', 'functionName', 'table', 'tableName', 'instanceId', 'group', 'groupId', 'key', 'keyId', 'vault', 'vaultName', 'pipeline', 'topic', 'queue', 'projectId', 'domain', 'secretName', 'roleName', 'accountName', 'resource', 'resourceId', 'name', 'arn'];
|
|
13
16
|
const REASON_KEYS = ['classification', 'title', 'message', 'reason', 'finding', 'detail'];
|
|
14
17
|
const UNKNOWN_PROVIDER = 'unknown';
|
|
15
18
|
// Scan-coverage gap prose — an EXACT 1:1 mirror of the EE evidence-gap anchor
|