nsauditor-ai 0.2.2 → 0.2.3

package/README.md

@@ -17,7 +17,7 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.2 + Enterprise 0.18.1** (June 2026) — paired docs release for EE 0.18.1: **GCP false-negative hardening II** (split-range firewall full-IPv4 coverage · IAM impersonation-graph completeness · default-object-ACL public exposure) + a **fleet-wide read-only enforcement guarantee** (a CI meta-test that makes it impossible to ship a mutating cloud API call across all 28 plugins) + the matching **read-only-credential requirement** (EULA §5.5). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED — substrate-depth fixes on already-covered controls.
+**Latest: CE 0.2.3 + Enterprise 0.18.2** (June 2026) — the MCP `scan_cloud` summary now **surfaces evidence-gaps**: a dedicated "Evidence gaps (unverified)" section so a Claude Desktop auditor sees the no-false-clean "we couldn't verify this" disclosures instead of a silent LOW count. Paired with **EE 0.18.2**, which retrofits the AWS S3 / Azure / IAM plugins to mark their scan-coverage gaps via a new CI producer-contract (so they reach the collector across all three clouds). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED.
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)

package/mcp_server.mjs

@@ -216,7 +216,7 @@ const TOOLS = [
   {
     name: 'scan_cloud',
     description:
-      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results.',
+      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean.',
     inputSchema: {
       type: 'object',
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/utils/cloud_finding_summary.mjs

@@ -35,8 +35,11 @@ function findingsOf(r) {
 /**
  * @param {Array} results              out.results (each {id, result:{findings|data}})
  * @param {(id:any)=>string|null} providerOf  plugin id -> cloudProvider
- * @param {number} [cap]               max CRITICAL/HIGH entries listed per provider
- * @returns {Object} { [provider]: { counts:{SEV:n}, findings:[{severity,plugin,title}], truncated:boolean } }
+ * @param {number} [cap]               max CRITICAL/HIGH entries listed per provider (also caps evidenceGaps independently)
+ * @returns {Object} { [provider]: { counts:{SEV:n}, findings:[{severity,plugin,title}], truncated:boolean,
+ *                                   evidenceGaps:[{severity,plugin,title}], evidenceGapsTruncated?:boolean } }
+ *   evidenceGaps surfaces findings carrying `details.evidenceGap === true` (the no-false-clean
+ *   "could not verify" disclosures) REGARDLESS of severity, so a LOW/INFO gap is never invisible.
  */
 export function summarizeCloudFindings(results, providerOf, cap = Number(process.env.CLOUD_FINDINGS_CAP) || 60) {
   const out = {};
@@ -59,13 +62,16 @@ export function summarizeCloudFindings(results, providerOf, cap = Number(process
     // bucketed under 'unknown' rather than silently dropped (defense-in-depth against a
     // future id collision / cloudProvider drift — never let a real finding vanish).
     const prov = providerOf(r?.id ?? r?.result?.id) || UNKNOWN_PROVIDER;
-    const bucket = (out[prov] ||= { counts: {}, findings: [], truncated: false });
+    const bucket = (out[prov] ||= { counts: {}, findings: [], evidenceGaps: [], truncated: false });
     for (const x of found) {
       const sev = String(x?.severity || x?.level || 'INFO').toUpperCase();
       bucket.counts[sev] = (bucket.counts[sev] || 0) + 1;
       if (sev === 'CRITICAL' || sev === 'HIGH') {
         bucket.findings.push({ severity: sev, plugin: String(r?.id ?? ''), title: describeFinding(x) });
       }
+      if (x && typeof x === 'object' && x.details && x.details.evidenceGap === true) {
+        bucket.evidenceGaps.push({ severity: sev, plugin: String(r?.id ?? ''), title: describeFinding(x) });
+      }
     }
   }
   // Sort by severity (CRITICAL first) THEN truncate — so a CRITICAL is never evicted
@@ -75,6 +81,7 @@ export function summarizeCloudFindings(results, providerOf, cap = Number(process
     const b = out[prov];
     b.findings.sort((a, c) => (RANK[c.severity] || 0) - (RANK[a.severity] || 0));
     if (b.findings.length > cap) { b.truncated = true; b.findings = b.findings.slice(0, cap); }
+    if (b.evidenceGaps.length > cap) { b.evidenceGapsTruncated = true; b.evidenceGaps = b.evidenceGaps.slice(0, cap); }
   }
   return out;
 }
@@ -119,6 +126,8 @@ export function renderCloudFindingsMarkdown(summary, providers) {
     lines.push(`## ${String(prov).toUpperCase()} — ${c.CRITICAL || 0} CRITICAL · ${c.HIGH || 0} HIGH · ${c.MEDIUM || 0} MEDIUM · ${c.LOW || 0} LOW · ${c.PASS || 0} PASS`);
     for (const f of (b.findings || [])) lines.push(`- **[${f.severity}]** ${f.plugin}: ${f.title}`);
     if (b.truncated) lines.push(`- _…CRITICAL/HIGH list truncated; see counts above for totals._`);
+    for (const g of (b.evidenceGaps || [])) lines.push(`- **[⚠ EVIDENCE GAP — unverified]** ${g.plugin}: ${g.title}`);
+    if (b.evidenceGapsTruncated) lines.push(`- _…evidence-gap list truncated; see LOW count for totals._`);
     lines.push('');
   }
   // Append the incomplete-coverage advisory (when present) as an informational note.