securenow 8.12.3 → 8.12.4

package/cli/threatModel.js

@@ -2,9 +2,10 @@
 
 // `securenow threat-model <category>` — print the copy-paste threat-modeling prompt for a category,
 // fetched from the published set at securenow.ai (the same prompt shown on securenow.ai/threat-modeling).
-// Pipe it straight into your coding agent:
-//   claude -p "$(npx securenow threat-model authentication)"
-// or save it:  npx securenow threat-model authentication --out prompt.md
+// Save it and have your coding agent follow the file (prompts run to ~136 KB, over
+// Linux's 128 KB single-argument limit, so `claude -p "$(...)"` fails):
+//   npx securenow threat-model authentication --out threat-prompt.md
+// or pipe it on stdin:  npx securenow threat-model authentication | claude -p
 const fs = require('fs');
 const ui = require('./ui');
 
@@ -34,8 +35,9 @@ function listCategories() {
   console.log('  Copy-paste a prompt into your coding agent, or run it with the SecureNow CLI.\n');
   for (const slug of CATEGORIES) console.log('    ' + slug);
   console.log('\n  Print one:  securenow threat-model authentication');
-  console.log('  Pipe it:    claude -p "$(securenow threat-model authentication)"');
-  console.log('  Save it:    securenow threat-model authentication --out prompt.md');
+  console.log('  Save it:    securenow threat-model authentication --out threat-prompt.md');
+  console.log('              then tell your agent: "Follow threat-prompt.md"');
+  console.log('  Pipe it:    securenow threat-model authentication | claude -p');
   console.log('  On the web: securenow.ai/threat-modeling');
 }
 

package/mcp/catalog.js

@@ -1852,6 +1852,54 @@ const TOOLS = [
   },
 ];
 
+// Annotation policy, matching how Claude's and ChatGPT's directory reviews read
+// the hints: a write is destructive when it removes or overwrites something,
+// or can stop production traffic or detection, even if it can be undone. Pure
+// record-keeping writes (reports, queue closures, read markers, dry runs) are
+// not. Only tools that reach arbitrary public entities are open-world.
+const DESTRUCTIVE_TOOLS = new Set([
+  'securenow_firewall_enable',
+  'securenow_firewall_disable',
+  'securenow_firewall_set_threshold',
+  'securenow_human_action_block',
+  'securenow_human_action_false_positive',
+  'securenow_human_case_action_update',
+  'securenow_automation_defaults_ensure',
+  'securenow_automation_rule_create',
+  'securenow_automation_rule_update',
+  'securenow_automation_rule_execute',
+  'securenow_automation_rule_delete',
+  'securenow_rate_limit_remove',
+  'securenow_rate_limit_create_from_text',
+  'securenow_alert_rule_rollback',
+  'securenow_alert_rule_update',
+  'securenow_alert_rule_query_update',
+  'securenow_alert_rule_instant_update',
+  'securenow_alert_rule_condition_update',
+  'securenow_alert_rule_exclusion_add',
+  'securenow_alert_rule_exclusion_remove',
+  'securenow_blocklist_pending_approve',
+  'securenow_blocklist_pending_reject',
+  'securenow_blocklist_pending_bulk_approve',
+  'securenow_blocklist_pending_bulk_reject',
+  'securenow_blocklist_add',
+  'securenow_blocklist_remove',
+  'securenow_blocklist_unblock',
+  'securenow_allowlist_add',
+  'securenow_allowlist_remove',
+  'securenow_trusted_add',
+  'securenow_trusted_remove',
+]);
+
+const OPEN_WORLD_TOOLS = new Set([
+  'securenow_ip_lookup', // reputation of any public IP address
+]);
+
+for (const tool of TOOLS) {
+  if (DESTRUCTIVE_TOOLS.has(tool.name)) tool.destructive = true;
+  tool.openWorld = OPEN_WORLD_TOOLS.has(tool.name);
+}
+
 const RESOURCES = [
   {
     uri: 'securenow://docs/skill-api',
@@ -2247,10 +2295,11 @@ function mcpToolDefinition(tool) {
     inputSchema: tool.inputSchema || objectSchema({}),
     annotations: {
       readOnlyHint: !!tool.readOnly,
-      destructiveHint: !!tool.destructive,
+      destructiveHint: !tool.readOnly && !!tool.destructive,
       idempotentHint: !!tool.readOnly,
-  },
-};
+      openWorldHint: !!tool.openWorld,
+    },
+  };
 }
 
 function listTools() {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "securenow",
-  "version": "8.12.3",
+  "version": "8.12.4",
+  "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",