nsauditor-ai 0.2.44 → 0.2.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -11
- package/cli.mjs +5 -4
- package/mcp_server.mjs +2 -2
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -7,7 +7,7 @@ A modular, AI-assisted network security audit platform that scans, understands,
|
|
|
7
7
|
[](https://www.npmjs.com/package/nsauditor-ai)
|
|
8
8
|
[](LICENSE)
|
|
9
9
|
[](https://nodejs.org)
|
|
10
|
-
[](#tests)
|
|
11
11
|
|
|
12
12
|
---
|
|
13
13
|
|
|
@@ -17,6 +17,20 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
|
|
|
17
17
|
|
|
18
18
|
## What's New
|
|
19
19
|
|
|
20
|
+
**Paired release with the Enterprise evidence-integrity patch (CE 0.2.46 / Enterprise 0.40.2).** No CE
|
|
21
|
+
code change — this publish exists because npm freezes this README at publish time: it delivers the
|
|
22
|
+
page corrections made since 0.2.45 (the eighth framework was missing from four places on this page;
|
|
23
|
+
the Activation section taught a stale form) and pairs the page with Enterprise 0.40.2. The Enterprise
|
|
24
|
+
half of the pair is an evidence-integrity fix to the **opt-in** RFC 3161 timestamping path
|
|
25
|
+
(`NSAUDITOR_TSA_URL`, no default authority): a Time-Stamp Authority **rejection** is now refused
|
|
26
|
+
rather than mistaken for a valid timestamp, recorded with one of five named reason codes in the
|
|
27
|
+
chain-of-custody envelope. The TSA policy-OID option also works on OpenSSL ≥ 3.0 hosts for the first
|
|
28
|
+
time (`-tspolicy` attempted, legacy `-policy` fallback), and internal `(Dim N)` dimension codes are
|
|
29
|
+
out of customer-facing GCP finding prose. **Peer floor unchanged: Enterprise requires CE ≥ 0.2.45,
|
|
30
|
+
which 0.2.46 satisfies.**
|
|
31
|
+
|
|
32
|
+
**The eighth compliance framework: NIST SP 800-171 Rev 2 (CE 0.2.45 / Enterprise 0.40.0).** Enterprise adds `--compliance nist-800-171`, and CE registers the stem so the MCP `scan_cloud` tool and the CLI accept it. ⚠️ **Requires CE ≥ 0.2.45** — CE 0.2.44 does NOT carry the stem, so an Enterprise 0.40.0 paired with an older CE will reject the framework name. What Enterprise produces is **evidence substrate an assessor reads**, scoped as *NIST SP 800-171 evidence substrate for CMMC Level 2 preparation*: it is **not** a CMMC certification, **not** a FedRAMP authorization, and it emits **no** MET/NOT MET determination and **no** SPRS score — those are a C3PAO's to make, and only a C3PAO's. All 110 Rev 2 requirements are enumerated with a written reason each; Rev 2 is pinned deliberately, because CMMC assesses Rev 2 by rule and Rev 3 is a different 97-requirement universe.
|
|
33
|
+
|
|
20
34
|
**`scan_cloud` stops naming a provider roster it cannot derive (CE 0.2.44 / Enterprise 0.39.0).** Paired with Enterprise 0.39.0 — **no CE scanning behaviour change, and the peer floor stays `>=0.2.43`, unraised.** The one thing that moves here is model-facing and npm freezes it, which is why it needs its own publish: the MCP `scan_cloud` tool description used to tell an assistant that *only the AWS plugins declare their capability boundaries; Azure and GCP declare none.* Enterprise 0.39.0 falsifies that — its seven GCP and Azure plugins now declare theirs — and a sentence read on every scan cannot be allowed to go stale on a peer's release. It is rewritten to state the invariant that is true in BOTH states and that CE can actually stand behind: **not every plugin declares its capability boundaries, so `deferredScope` bounds only what the DECLARING plugins state and is never a coverage inventory** — an empty or short list is not a claim of full coverage. CE floats over a peer RANGE and cannot derive Enterprise's plugin roster, so any sentence that counted providers was a claim it had no way to check. Also here: the edition-comparison chart gains the Ed25519 evidence-pack signing row, carrying its permanent scope in-sentence — one framework's envelope and the artifacts it enumerates, an operator-held key, never a vendor attestation. **And a second fix, found by trying to USE the previous release's headline:** `compliance sign-pack` and `compliance verify-pack` dispatched correctly but were **absent from `nsauditor-ai help`** for the whole of 0.2.43 — documented in every README, changelog and design record, and missing from the one surface a user actually reads. Both now carry usage blocks, and a guard derives the dispatched verb set from the dispatch site and asserts help/dispatch equality in both directions, so a reachable-but-undiscoverable command fails the build.
|
|
21
35
|
|
|
22
36
|
**The pack-signing commands land in the CLI — reachable, and not yet proven at that release (CE 0.2.43 / Enterprise 0.38.0).** ⚠️ **Correcting this entry's own words: that gate has since RUN.** On 2026-08-17 it ran against the published EE 0.38.0 registry bytes and passed, so evidence-pack signing is PROVEN for an operator-held key over one framework's envelope and the artifacts it enumerates, never a vendor attestation. `nsauditor-ai compliance sign-pack --manifest <envelope>` signs a chain-of-custody envelope with an operator-held Ed25519 key; `compliance verify-pack` establishes authorship from it — via `--registry` (your identity registry, with revocation and validity checked **as at signing time**) or `--public-key` (which discloses in its own output that those checks did not run). Both are thin forwards: Enterprise owns every decision and refusal, CE contributes the flags and the exit code. **Verify does more than the signature** — it recomputes every `artifacts[].sha256` against disk, so a signed pack whose report was edited returns a failure with the signature still reading VERIFIED. Exit **0** verified · **1** a violation · **2** the run could not measure, and the third is never a failure. Requires the Enterprise package; an auditor can also verify offline with `openssl` and nothing of ours, because the exact signed bytes ship beside the signature. **⚠️ Also a correction affecting 0.2.42/0.37.0:** a **gzipped** KEV/EPSS store — the default shape, since FIRST distributes EPSS only as `.csv.gz` — loaded with ZERO entries, so every finding reported *no store* rather than an exploit band. Misdiagnosis and silent degradation, **not** a false security verdict: findings carried a visible no-store marker throughout. Compression is now decided by file content rather than by filename.
|
|
@@ -59,10 +73,10 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
|
|
|
59
73
|
|
|
60
74
|
### Why upgrade to Enterprise?
|
|
61
75
|
|
|
62
|
-
If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8,
|
|
76
|
+
If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, GDPR Article 32, or NIST SP 800-171 / CMMC Level 2 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
|
|
63
77
|
|
|
64
78
|
- ☁️ **28 enterprise plugins — 27 cloud auditors across AWS / Azure / GCP, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
|
|
65
|
-
- 📋 **
|
|
79
|
+
- 📋 **8 compliance frameworks shipped** — generate any combination from a single scan:
|
|
66
80
|
- **SOC 2** (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
|
|
67
81
|
- **HIPAA Security Rule §164.312** — 7 covered + 3 partial Technical Safeguards; **Zero BAA required** (ePHI never leaves your infrastructure)
|
|
68
82
|
- **NIST CSF 2.0 Core** (NIST CSWP 29, Feb 2024) — 13 covered + 10 partial Subcategories across 106 of CSF 2.0's 107 Subcategories; Subcategory-level mapping (auditor-canonical, not high-level Function/Category claims)
|
|
@@ -70,12 +84,13 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
|
|
|
70
84
|
- **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
|
|
71
85
|
- **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
|
|
72
86
|
- **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
|
|
87
|
+
- **NIST SP 800-171 Rev 2** (NIST, Feb 2020; the baseline CMMC assesses by rule) — **2 covered + 49 partial + 59 OOS across all 110 requirements**, claimed at the SP 800-171A determination-statement level. ⚠️ This is EXAMINE-method evidence substrate for **CMMC Level 2 preparation** — not a CMMC certification, not a FedRAMP authorization, and it emits no MET/NOT MET determination and no SPRS score; each of those is a C3PAO's to make.
|
|
73
88
|
- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name plus the `openssl` binary, and were exercised against a live Time-Stamp Authority on the npm path on 2026-08-07: the auditor procedure `openssl ts -verify` returned OK, with a one-byte-mutated copy returning FAILED as the control. The `:0.33.0` Marketplace image is proven too: on 2026-08-08 the same round-trip was driven from inside the pushed image against a real authority, verified with the image’s own `openssl`. **Retained images at `:0.32.11` and earlier carry no `openssl` at all**, so nothing here speaks for them. **Ed25519 suppression signing became reachable in EE 0.35.0 via `compliance suppress`** and is **proven as of EE 0.36.0 for approvers whose registry entry carries key material** — a shipped entry point signs, and a one-character length-preserving tamper makes the report render `signature FAILED verification`. A fingerprint-only registry entry reads `not checked by this report`, which records that no check ran and never that one failed.
|
|
74
89
|
- 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
|
|
75
90
|
- 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
|
|
76
91
|
- 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
|
|
77
92
|
- 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
|
|
78
|
-
- 🎯 **14 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain
|
|
93
|
+
- 🎯 **14 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 9-of-9 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + NIST SP 800-171 + GRC connector)
|
|
79
94
|
|
|
80
95
|
→ **[See sample EE scan output](https://www.nsauditor.com/ai/docs/sample-scan/)** — full evidence pack against synthetic Acme Corp AWS account (no signup required)
|
|
81
96
|
→ **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/pricing/)** — $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.
|
|
@@ -107,7 +122,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
|
|
|
107
122
|
| **Enterprise — cloud scanning** | | | |
|
|
108
123
|
| 28 enterprise plugins — 27 cloud (AWS / Azure / GCP) + 1 network-scan zero-trust check | — | — | ✅ |
|
|
109
124
|
| Zero Trust assessment | — | — | ✅ |
|
|
110
|
-
| **Enterprise — compliance (
|
|
125
|
+
| **Enterprise — compliance (8 frameworks)** | | | |
|
|
111
126
|
| SOC 2 (AICPA TSC 2017) — 10 covered + 4 partial controls | — | — | ✅ |
|
|
112
127
|
| HIPAA Security Rule §164.312 — Zero BAA required | — | — | ✅ |
|
|
113
128
|
| NIST CSF 2.0 Core — Subcategory-level mapping (106 of 107 Subcategories) | — | — | ✅ |
|
|
@@ -115,7 +130,8 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
|
|
|
115
130
|
| ISO/IEC 27001:2022 — per-Annex-A-code mapping + SoA discipline (93 Annex A controls) | — | — | ✅ |
|
|
116
131
|
| CIS Critical Security Controls v8 — per-Safeguard mapping + IG-cumulative discipline (153 Safeguards / 18 Controls) | — | — | ✅ |
|
|
117
132
|
| **GDPR Article 32 (Security of Processing)** — Art. 32 infrastructure substrate (4 covered + 5 partial + 2 OOS / 11 sub-measure units); **not GDPR compliance** · Art. 83(4) lower fine tier | — | — | ✅ |
|
|
118
|
-
|
|
|
133
|
+
| **NIST SP 800-171 Rev 2** — evidence substrate for **CMMC Level 2 preparation**; all 110 Rev 2 requirements enumerated (2 covered + 49 partial + 59 OOS). **Not a certification, not a FedRAMP authorization, no MET/NOT MET verdict, no SPRS score** | — | — | ✅ |
|
|
134
|
+
| Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` from one scan | — | — | ✅ |
|
|
119
135
|
| **Enterprise — auditor-grade evidence** | | | |
|
|
120
136
|
| Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in via `NSAUDITOR_TSA_URL`, exercised against a live TSA on both the npm path and the `:0.33.0` container image; retained images `:0.32.11` and earlier carry no `openssl`) | — | — | ✅ |
|
|
121
137
|
| Suppression workflow with approver identity verification (Ed25519 SIGNING reachable 0.35.0, proven 0.36.0, verified per approver holding **key material**) | — | — | ✅ |
|
|
@@ -708,7 +724,7 @@ nsauditor-ai --version (or -v, or `version`)
|
|
|
708
724
|
| `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
|
|
709
725
|
| `--webhook-url <url>` | Webhook URL for delta alerts | — |
|
|
710
726
|
| `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
|
|
711
|
-
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, `gdpr`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr`). **Enterprise license required.** Supported frameworks as of EE 0.
|
|
727
|
+
| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, `gdpr`, `nist-800-171`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` — `all` expands to the same eight). **Enterprise license required.** Supported frameworks as of EE 0.40.0 — **eight**: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022) + `cis-v8` (CIS Critical Security Controls v8, CIS May 2021 / v8.1 errata June 2024) + `gdpr` (GDPR Article 32 / Security of Processing, Regulation (EU) 2016/679 — Art. 32 infrastructure substrate, **not** GDPR compliance) + `nist-800-171` (NIST SP 800-171 Rev 2 — evidence substrate for **CMMC Level 2 preparation**, **not** a CMMC certification, **not** a FedRAMP authorization, and no MET/NOT MET determination or SPRS score). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
|
|
712
728
|
| `--compliance-scope <path>` | Optional JSON file describing the assessment scope (passed to the compliance engine for cover-page attestation) | — |
|
|
713
729
|
| `--help`, `-h` | Print usage block (subcommands, flags, env vars, examples) and exit 0 | — |
|
|
714
730
|
| `--version`, `-v` | Print `nsauditor-ai <version>` and exit 0 | — |
|
|
@@ -1035,11 +1051,12 @@ export default {
|
|
|
1035
1051
|
After purchasing at [nsauditor.com/ai/pricing](https://www.nsauditor.com/ai/pricing), you'll receive an email with your license key and an npm install command. Two steps:
|
|
1036
1052
|
|
|
1037
1053
|
```bash
|
|
1038
|
-
# 1. Install
|
|
1054
|
+
# 1. Install both packages (one-time, token included in email — the base package carries the CLI)
|
|
1055
|
+
npm install -g nsauditor-ai
|
|
1039
1056
|
npm install -g @nsasoft/nsauditor-ai-ee --//registry.npmjs.org/:_authToken=npm_xxxxx
|
|
1040
1057
|
|
|
1041
|
-
# 2.
|
|
1042
|
-
|
|
1058
|
+
# 2. Install your license key — identical on macOS, Linux and Windows, no environment variable needed
|
|
1059
|
+
nsauditor-ai license install "pro_eyJhbGci..."
|
|
1043
1060
|
```
|
|
1044
1061
|
|
|
1045
1062
|
Verify:
|
|
@@ -1062,7 +1079,7 @@ No license key? Everything in this repository works perfectly without one. The C
|
|
|
1062
1079
|
|
|
1063
1080
|
## Tests
|
|
1064
1081
|
|
|
1065
|
-
Run all
|
|
1082
|
+
Run all 1308 tests:
|
|
1066
1083
|
|
|
1067
1084
|
```bash
|
|
1068
1085
|
npm test
|
package/cli.mjs
CHANGED
|
@@ -1165,9 +1165,10 @@ Scan options:
|
|
|
1165
1165
|
--interval <minutes> Watch interval (default 60)
|
|
1166
1166
|
--webhook-url <url> Send delta alerts (must be public; private/loopback blocked)
|
|
1167
1167
|
--alert-severity <sev> Min severity to alert on (default: high)
|
|
1168
|
-
--compliance <framework> Map findings to controls. 'all' = all
|
|
1169
|
-
|
|
1170
|
-
nist/pci/iso/cis
|
|
1168
|
+
--compliance <framework> Map findings to controls. 'all' = all 8 frameworks, or a CSV of
|
|
1169
|
+
soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171
|
|
1170
|
+
(aliases nist/pci/iso/cis, and 800-171 or cmmc for nist-800-171 --
|
|
1171
|
+
nist stays NIST CSF). Unknown tokens fail fast. Enterprise only.
|
|
1171
1172
|
--compliance-scope <path> JSON file describing the assessment scope
|
|
1172
1173
|
--compliance-history <dir> Directory of prior scans (one subdirectory per scan). Turns on
|
|
1173
1174
|
SLA/MTTR longitudinal tracking against that history. Enterprise.
|
|
@@ -1314,7 +1315,7 @@ Cloud-scan hosts:
|
|
|
1314
1315
|
Examples:
|
|
1315
1316
|
nsauditor-ai scan --host 10.0.0.1 --plugins all
|
|
1316
1317
|
CLOUD_PROVIDER=aws AWS_PROFILE=default \\
|
|
1317
|
-
nsauditor-ai scan --host aws --plugins all --compliance all # full AWS audit, all
|
|
1318
|
+
nsauditor-ai scan --host aws --plugins all --compliance all # full AWS audit, all 8 frameworks
|
|
1318
1319
|
nsauditor-ai scan --host aws,gcp,azure --plugins all --compliance all # all 3 clouds in one run
|
|
1319
1320
|
nsauditor-ai scan --host 10.0.0.0/24 --plugins all --compliance soc2
|
|
1320
1321
|
nsauditor-ai license install enterprise_eyJhbGciOiJFUzI1NiIs...
|
package/mcp_server.mjs
CHANGED
|
@@ -231,7 +231,7 @@ const GET_FINDINGS_MAX_LIMIT = 20; // ~500 chars/finding -> ~10KB page (Deskto
|
|
|
231
231
|
// description that goes stale silently steers an assistant's tool selection and errors nowhere.
|
|
232
232
|
// Everything below DERIVES from this array. Do not re-type it.
|
|
233
233
|
export const FRAMEWORK_STEMS = Object.freeze([
|
|
234
|
-
'soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr',
|
|
234
|
+
'soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr', 'nist-800-171',
|
|
235
235
|
]);
|
|
236
236
|
|
|
237
237
|
// Exported for direct testing (the scan_cloud description is a routing surface —
|
|
@@ -259,7 +259,7 @@ export const TOOLS = [
|
|
|
259
259
|
{
|
|
260
260
|
name: 'scan_cloud',
|
|
261
261
|
description:
|
|
262
|
-
'Audit cloud accounts (AWS / GCP / Azure) for security & compliance posture. Enterprise license. ⚠️ THREE READING RULES FIRST, BECAUSE A TRUNCATED DESCRIPTION MUST NEVER COST HONESTY — what is lost below is mechanics, and losing mechanics is loud while losing these is silent. (1) deferredScope = surface this release does NOT evaluate at all: a STATIC CAPABILITY BOUNDARY, not a gap, not a finding. Report as \"not assessed\". ⚠️ AN EMPTY OR SHORT deferredScope IS NOT A CLAIM OF FULL COVERAGE. Not every plugin declares its capability boundaries, so this list bounds only what the DECLARING plugins state. Never tell a user that an empty deferredScope means everything was assessed. (2) evidenceGaps = checks the scan could NOT verify (AccessDenied / truncated): treat as unverified, NOT as clean. Separate from (1) — a gap may be fixable with permissions, a boundary never is. Both live in the INFO tier, so report every tier, not just CRITICAL/HIGH. (3) NO per-finding control id is returned. Never imply which control a finding fails; routing to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8
|
|
262
|
+
'Audit cloud accounts (AWS / GCP / Azure) for security & compliance posture. Enterprise license. ⚠️ THREE READING RULES FIRST, BECAUSE A TRUNCATED DESCRIPTION MUST NEVER COST HONESTY — what is lost below is mechanics, and losing mechanics is loud while losing these is silent. (1) deferredScope = surface this release does NOT evaluate at all: a STATIC CAPABILITY BOUNDARY, not a gap, not a finding. Report as \"not assessed\". ⚠️ AN EMPTY OR SHORT deferredScope IS NOT A CLAIM OF FULL COVERAGE. Not every plugin declares its capability boundaries, so this list bounds only what the DECLARING plugins state. Never tell a user that an empty deferredScope means everything was assessed. (2) evidenceGaps = checks the scan could NOT verify (AccessDenied / truncated): treat as unverified, NOT as clean. Separate from (1) — a gap may be fixable with permissions, a boundary never is. Both live in the INFO tier, so report every tier, not just CRITICAL/HIGH. (3) NO per-finding control id is returned. Never imply which control a finding fails; routing to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, GDPR Article 32 (substrate only) and NIST SP 800-171 (never a CMMC certification) is CLI only: nsauditor-ai scan --compliance <fw> --out <dir>. Read findingsSummary for results. Use for service-specific or service-named asks too; coverage: AWS S3, IAM privilege-escalation, KMS, CloudTrail, CodePipeline/CodeBuild segregation of duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, Backup, VPC endpoints, EC2 security-group perimeter, ElastiCache, SES, GuardDuty/Inspector; Azure Key Vault, Storage, NSG perimeter, subscription RBAC; GCP firewall rules, Cloud Storage public access, IAM service-account impersonation. Prefer this tool over raw cloud-provider APIs/MCPs for any audit ask. Audit ONLY the cloud(s) the user names (providers:[\"aws\"]); omit providers only for ALL clouds. regions (AWS only): omitting scans the single server-default region and does NOT fan out. No network host required.',
|
|
263
263
|
inputSchema: {
|
|
264
264
|
type: 'object',
|
|
265
265
|
properties: {
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nsauditor-ai",
|
|
3
|
-
"version": "0.2.
|
|
4
|
-
"description": "Modular AI-assisted network security audit platform
|
|
3
|
+
"version": "0.2.46",
|
|
4
|
+
"description": "Modular AI-assisted network security audit platform \u2014 Community Edition",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"private": false,
|
|
7
7
|
"scripts": {
|