securenow 8.12.2 → 8.12.4

package/cli/threatModel.js

@@ -0,0 +1,82 @@
+'use strict';
+
+// `securenow threat-model <category>` — print the copy-paste threat-modeling prompt for a category,
+// fetched from the published set at securenow.ai (the same prompt shown on securenow.ai/threat-modeling).
+// Save it and have your coding agent follow the file (prompts run to ~136 KB, over
+// Linux's 128 KB single-argument limit, so `claude -p "$(...)"` fails):
+//   npx securenow threat-model authentication --out threat-prompt.md
+// or pipe it on stdin:  npx securenow threat-model authentication | claude -p
+const fs = require('fs');
+const ui = require('./ui');
+
+const BASE = process.env.SECURENOW_THREAT_PROMPTS_URL || 'https://securenow.ai/threat-prompts';
+
+// Published categories (slugs). Aliases map common shorthands to the slug.
+const CATEGORIES = [
+  'authentication', 'authorization', 'xss-csrf-cors', 'client-side-supply-chain', 'injection',
+  'oauth-sso-integrations', 'admin-support-tools', 'payment-business-logic', 'file-upload-download',
+  'messaging-notifications', 'rate-limits-and-abuse', 'legacy-endpoints', 'api-security', 'graphql-security',
+  'webhooks', 'realtime-websocket-sse', 'serverless-and-edge', 'cloud-infrastructure', 'secrets-and-cloud-iam',
+  'dns-tls-certificates', 'supply-chain-cicd', 'storage-and-logs', 'data-privacy-pii', 'ai-llm-features',
+  'secrets-and-api-key-hygiene',
+];
+const ALIASES = { auth: 'authentication', authz: 'authorization', oauth: 'oauth-sso-integrations', sso: 'oauth-sso-integrations', api: 'api-security', graphql: 'graphql-security', uploads: 'file-upload-download', upload: 'file-upload-download', xss: 'xss-csrf-cors', csrf: 'xss-csrf-cors', cors: 'xss-csrf-cors', rate: 'rate-limits-and-abuse', 'rate-limits': 'rate-limits-and-abuse', secrets: 'secrets-and-api-key-hygiene', privacy: 'data-privacy-pii', pii: 'data-privacy-pii', ai: 'ai-llm-features', llm: 'ai-llm-features' };
+
+function resolveSlug(input) {
+  const raw = String(input || '').trim().toLowerCase().replace(/\.md$/, '').replace(/^\d+[-_]/, '');
+  if (!raw) return null;
+  if (CATEGORIES.includes(raw)) return raw;
+  if (ALIASES[raw]) return ALIASES[raw];
+  return null;
+}
+
+function listCategories() {
+  ui.heading('SecureNow threat-modeling prompts');
+  console.log('  Copy-paste a prompt into your coding agent, or run it with the SecureNow CLI.\n');
+  for (const slug of CATEGORIES) console.log('    ' + slug);
+  console.log('\n  Print one:  securenow threat-model authentication');
+  console.log('  Save it:    securenow threat-model authentication --out threat-prompt.md');
+  console.log('              then tell your agent: "Follow threat-prompt.md"');
+  console.log('  Pipe it:    securenow threat-model authentication | claude -p');
+  console.log('  On the web: securenow.ai/threat-modeling');
+}
+
+async function run(args, flags = {}) {
+  const category = args[0];
+  if (flags.list || (!category && !flags.all)) {
+    if (!category && !flags.list) ui.info('Pick a category (or --list to see them all):\n');
+    listCategories();
+    return;
+  }
+
+  const slug = resolveSlug(category);
+  if (!slug) {
+    ui.error(`Unknown category "${category}". Run "securenow threat-model --list" to see the ${CATEGORIES.length} categories.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const url = `${BASE}/${slug}.md`;
+  let text;
+  try {
+    const res = await fetch(url, { headers: { accept: 'text/markdown, text/plain' } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    text = await res.text();
+  } catch (err) {
+    ui.error(`Could not fetch the ${slug} prompt (${err.message}). Open securenow.ai/threat-modeling/${slug} in a browser instead.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (flags.out) {
+    fs.writeFileSync(flags.out, text);
+    ui.success(`Saved the ${slug} threat-model prompt to ${flags.out} (${text.length.toLocaleString()} chars).`);
+    ui.info('Open it with your coding agent at the root of a project that has the securenow SDK installed.');
+    return;
+  }
+
+  // Default: raw prompt to stdout so it pipes cleanly into an agent.
+  process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+}
+
+module.exports = { run, resolveSlug, CATEGORIES, ALIASES };

package/cli.js

@@ -671,6 +671,12 @@ const COMMANDS = {
     rawArgv: true,
     run: (rawArgs) => require('./cli/run').run(rawArgs),
   },
+  'threat-model': {
+    desc: 'Print a copy-paste threat-modeling prompt for a category (pipe it into your coding agent)',
+    usage: 'securenow threat-model <authentication|authorization|…|--list> [--out prompt.md]',
+    flags: { list: 'List all threat-modeling categories', out: 'Write the prompt to a file instead of stdout' },
+    run: (a, f) => require('./cli/threatModel').run(a, f),
+  },
   redact: {
     desc: 'Redact sensitive fields and OTP codes from a JSON payload',
     usage: "securenow redact '<json>' [--fields f1,f2] [--json]",
@@ -822,7 +828,7 @@ function showHelp(commandName) {
     'Firewall': ['firewall'],
     'Remediation': ['automation', 'ratelimit', 'challenge', 'blocklist', 'revoke', 'allowlist', 'trusted'],
     'Telemetry': ['telemetry', 'log', 'event', 'test-span'],
-    'Utilities': ['redact', 'cidr', 'doctor', 'env', 'mcp'],
+    'Utilities': ['threat-model', 'redact', 'cidr', 'doctor', 'env', 'mcp'],
     'Settings': ['instances', 'config', 'version'],
   };
 

package/mcp/catalog.js

@@ -1852,6 +1852,54 @@ const TOOLS = [
   },
 ];
 
+// Annotation policy, matching how Claude's and ChatGPT's directory reviews read
+// the hints: a write is destructive when it removes or overwrites something,
+// or can stop production traffic or detection, even if it can be undone. Pure
+// record-keeping writes (reports, queue closures, read markers, dry runs) are
+// not. Only tools that reach arbitrary public entities are open-world.
+const DESTRUCTIVE_TOOLS = new Set([
+  'securenow_firewall_enable',
+  'securenow_firewall_disable',
+  'securenow_firewall_set_threshold',
+  'securenow_human_action_block',
+  'securenow_human_action_false_positive',
+  'securenow_human_case_action_update',
+  'securenow_automation_defaults_ensure',
+  'securenow_automation_rule_create',
+  'securenow_automation_rule_update',
+  'securenow_automation_rule_execute',
+  'securenow_automation_rule_delete',
+  'securenow_rate_limit_remove',
+  'securenow_rate_limit_create_from_text',
+  'securenow_alert_rule_rollback',
+  'securenow_alert_rule_update',
+  'securenow_alert_rule_query_update',
+  'securenow_alert_rule_instant_update',
+  'securenow_alert_rule_condition_update',
+  'securenow_alert_rule_exclusion_add',
+  'securenow_alert_rule_exclusion_remove',
+  'securenow_blocklist_pending_approve',
+  'securenow_blocklist_pending_reject',
+  'securenow_blocklist_pending_bulk_approve',
+  'securenow_blocklist_pending_bulk_reject',
+  'securenow_blocklist_add',
+  'securenow_blocklist_remove',
+  'securenow_blocklist_unblock',
+  'securenow_allowlist_add',
+  'securenow_allowlist_remove',
+  'securenow_trusted_add',
+  'securenow_trusted_remove',
+]);
+
+const OPEN_WORLD_TOOLS = new Set([
+  'securenow_ip_lookup', // reputation of any public IP address
+]);
+
+for (const tool of TOOLS) {
+  if (DESTRUCTIVE_TOOLS.has(tool.name)) tool.destructive = true;
+  tool.openWorld = OPEN_WORLD_TOOLS.has(tool.name);
+}
+
 const RESOURCES = [
   {
     uri: 'securenow://docs/skill-api',
@@ -2247,10 +2295,11 @@ function mcpToolDefinition(tool) {
     inputSchema: tool.inputSchema || objectSchema({}),
     annotations: {
       readOnlyHint: !!tool.readOnly,
-      destructiveHint: !!tool.destructive,
+      destructiveHint: !tool.readOnly && !!tool.destructive,
       idempotentHint: !!tool.readOnly,
-  },
-};
+      openWorldHint: !!tool.openWorld,
+    },
+  };
 }
 
 function listTools() {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "securenow",
-  "version": "8.12.2",
+  "version": "8.12.4",
+  "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",