securenow 8.17.0 → 8.18.0

package/SKILL-CLI.md

@@ -28,6 +28,22 @@ npx -p securenow securenow-mcp
 
 The MCP server reads admin/control-plane auth from `.securenow/admin.json` and SDK runtime app credentials from `.securenow/runtime.json`, with legacy `.securenow/credentials.json` still supported. Admin/global tools use admin auth; runtime-scoped read tools can use the runtime API key where its scopes allow it. Write tools require `confirm:true` plus a reason.
 
+**For agents, prefer the hosted MCP** (`https://api.securenow.ai/mcp`, OAuth sign-in, no install and always the current tools). With the local stdio server, warm the package once so the first connection doesn't time out on the download (`npx -y securenow@latest --version`), and give the client a longer connect timeout (Claude Code: `MCP_TIMEOUT=120000`).
+
+**Tool profiles** (stdio server): `securenow mcp --profile <name>` (or `SECURENOW_MCP_PROFILE=<name>`) serves only the tools one job needs, so the agent carries less context. Every profile keeps `securenow_auth_status`, `securenow_apps_list` and `securenow_apps_info`; calling a tool outside the profile returns an error naming the profile.
+
+| Profile | Tools | What's in it |
+|---|---|---|
+| `all` (default) | 112 | everything |
+| `investigator` | 58 | every read-only tool, plus forensics question/chat/confirm |
+| `detection` | 47 | `securenow_alert_rule*` (draft, create, test, run, runs, explain, versions, exclusions, request promotion…), traces, logs, forensics, IP intelligence, notifications list/get |
+| `responder` | 77 | notifications, human queue, alert reviews, blocklist, allowlist, trusted IPs, rate limits, challenges, automations, firewall, IP intelligence, plus rule get/runs/explain and traces/logs for context |
+
+```bash
+claude mcp add securenow-investigator -- npx -y securenow@latest mcp --profile investigator
+codex mcp add securenow-detection -- npx securenow mcp --profile detection
+```
+
 ### Authenticate
 
 ```bash
@@ -213,8 +229,11 @@ securenow traces analyze <traceId> --env production   # AI-powered trace analysi
 securenow logs [--app <key>] [--env production] [--limit N] [--minutes M] [--level error|warn|info]
 securenow logs list --app my-app --env production --minutes 30 --level error
 securenow logs trace <traceId> --env production       # logs correlated to a specific trace
+securenow logs errors --app my-app --since 6h [--warn]  # what is failing: error lines grouped by message (ids/numbers normalized), counts, first/last seen, sample traces
 ```
 
+For "what's broken right now?", start with `logs errors` (MCP `securenow_logs_errors`): one call returns the distinct failures, not hundreds of raw lines.
+
 ### Notifications
 
 ```bash
@@ -295,6 +314,7 @@ securenow alerts rules delete <id> --yes    # delete a custom rule (system rules
 securenow alerts rules update <id> --applications-all   # all current & future apps
 securenow alerts rules update <id> --apps key1,key2     # explicit app keys only
 securenow alerts rules test <id> --wait       # dry-run an existing rule's query (default; --mode live inserts 6 synthetic attack requests)
+securenow alerts rules change <id> "raise the threshold to 20"   # rewrite a rule from English: checked, shown before/after, applied as a new version
 securenow alerts rules runs <id> [--since 1h] # what each run saw and why it did or didn't notify (+ next scheduled run)
 securenow alerts rules run <id>               # run a periodic rule now and print the run (--no-wait to just queue it)
 securenow alerts rules why <id> --ip <ip> [--since 1h]   # why the rule did or didn't alert on one address: verdict + findings
@@ -322,6 +342,8 @@ right tenant-scope column per table: logs (`signoz_logs.distributed_logs_v2`) us
 
 MCP parity for quiet rules: `securenow_alert_rule_runs` (run history), `securenow_alert_rule_run_now` (write, confirm) and `securenow_alert_rule_explain` (`ip`, `since`: verdict + findings).
 
+**Agents don't promote rules; they ask.** When a test-mode rule has proved itself, an agent runs `securenow alerts rules request-promotion <id> --reason "..." --evidence "..."` (MCP `securenow_alert_rule_request_promotion`). A person sees it on the rules page or with `securenow human promotions` and runs `securenow human approve-promotion <request-id> --yes` (the rule goes to prod, recorded as a rule version naming the approver) or `deny-promotion <request-id> --reason "..."`. API keys and MCP tokens can ask but not decide.
+
 MCP parity for noisy alert-rule reviews:
 
 - `securenow_alert_rule_get`

package/cli/human.js

@@ -569,6 +569,66 @@ async function work(args, flags) {
   console.log('');
 }
 
+// ── Rule promotion requests ──
+// Agents create rules in test mode and ask a person to promote them. A person approves (the rule
+// goes to prod, recorded as a rule version) or denies here or on the dashboard's rules page.
+
+async function promotions(args, flags) {
+  requireAuth();
+  const status = typeof flags.status === 'string' ? flags.status : 'pending';
+  const s = ui.spinner('Fetching promotion requests');
+  let data;
+  try {
+    data = await api.get('/alert-rules/promotion-requests', { query: { status, limit: flags.limit || 50 } });
+    s.stop(`Found ${(data.requests || []).length} ${status === 'all' ? '' : `${status} `}request${(data.requests || []).length === 1 ? '' : 's'}`);
+  } catch (err) {
+    s.fail('Failed to fetch promotion requests');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+  const requests = data.requests || [];
+  if (requests.length === 0) { ui.info('No promotion requests waiting.'); return; }
+  console.log('');
+  for (const r of requests) {
+    console.log(`  ${ui.c.bold(r.ruleName || r.ruleId)}  ${ui.c.dim(r.id)}  ${r.status}`);
+    console.log(`    asked by ${r.requestedBy?.name || r.requestedBy?.kind || 'unknown'} ${ui.timeAgo(r.createdAt)}: ${r.reason}`);
+    if (r.evidence) console.log(ui.c.dim(`    evidence: ${ui.truncate(String(r.evidence).replace(/\s+/g, ' '), 160)}`));
+    if (r.status !== 'pending') console.log(ui.c.dim(`    ${r.status} by ${r.decidedByName || 'someone'}${r.decisionNote ? `: ${r.decisionNote}` : ''}`));
+  }
+  console.log('');
+  if (requests.some((r) => r.status === 'pending')) {
+    console.log(ui.c.dim('  Approve: securenow human approve-promotion <id> --yes [--note "..."]   Deny: securenow human deny-promotion <id> --reason "..."'));
+    console.log(ui.c.dim('  Before approving, check what it would arm: securenow alerts rules show <ruleId> and securenow alerts rules runs <ruleId>'));
+    console.log('');
+  }
+}
+
+async function decidePromotion(args, flags, decision) {
+  requireAuth();
+  const id = args[0];
+  const verb = decision === 'approve' ? 'approve-promotion' : 'deny-promotion';
+  if (!id) {
+    ui.error(`Usage: securenow human ${verb} <request-id> ${decision === 'approve' ? '--yes [--note "..."]' : '--reason "..."'}`);
+    process.exit(1);
+  }
+  if (decision === 'approve' && !flags.yes && !flags.force) {
+    ui.warn('Approving moves the rule to prod: its instant block, matching automations and the AI pipeline can act on its alerts.');
+    const ok = await ui.confirm('Approve this promotion?');
+    if (!ok) { ui.info('Cancelled'); return; }
+  }
+  const note = flags.note || flags.reason || '';
+  const s = ui.spinner(decision === 'approve' ? 'Approving' : 'Denying');
+  try {
+    const data = await api.post(`/alert-rules/promotion-requests/${id}/${decision}`, { note });
+    s.stop(decision === 'approve' ? `Approved: "${data.alertRule?.name || data.request?.ruleName}" is in prod` : 'Denied: the rule stays in test mode');
+    for (const warning of data.warnings || []) ui.warn(warning);
+    if (flags.json) ui.json(data);
+  } catch (err) {
+    s.fail(`Failed to ${decision} the promotion`);
+    throw err;
+  }
+}
+
 module.exports = {
   list,
   show,
@@ -578,4 +638,7 @@ module.exports = {
   report,
   prompt,
   work,
+  promotions,
+  approvePromotion: (args, flags) => decidePromotion(args, flags, 'approve'),
+  denyPromotion: (args, flags) => decidePromotion(args, flags, 'deny'),
 };

package/cli/monitor.js

@@ -294,6 +294,48 @@ async function logsList(args, flags) {
   }
 }
 
+// Error lines grouped by message (ids and numbers normalized): what is failing, how often, since when.
+async function logsErrors(args, flags) {
+  requireAuth();
+  const appKey = resolveApp(flags);
+  if (!appKey) {
+    ui.error('No app specified. Use --app <key> or set a default.');
+    process.exit(1);
+  }
+  const query = { appKeys: appKey, since: flags.since || '1h', limit: flags.limit || 20 };
+  if (flags.warn) query.includeWarn = 'true';
+  addEnvironment(query, flags);
+  const s = ui.spinner('Grouping error logs');
+  let data;
+  try {
+    data = await api.get('/logs/errors', { query });
+    const kind = data.includeWarn ? 'error/warning' : 'error';
+    s.stop(`${data.total} ${kind} line${data.total === 1 ? '' : 's'} in ${data.distinct} group${data.distinct === 1 ? '' : 's'}`);
+  } catch (err) {
+    s.fail('Failed to summarize error logs');
+    throw err;
+  }
+  if (flags.json) { ui.json(data); return; }
+  const groups = data.groups || [];
+  console.log('');
+  if (groups.length === 0) { ui.info(`No ${data.includeWarn ? 'warnings or errors' : 'errors'} since ${data.window?.from}.`); return; }
+  for (const g of groups) {
+    const last = g.lastSeen ? ui.timeAgo(g.lastSeen) : '';
+    console.log(`  ${ui.c.red(String(g.occurrences).padStart(5))}  ${ui.truncate(String(g.sample || g.signature).replace(/\s+/g, ' '), 110)}`);
+    const meta = [
+      (g.severities || []).join('/'),
+      (g.environments || []).join(', '),
+      g.exceptionType,
+      last && `last ${last}`,
+      g.sampleTraceIds?.[0] && `trace ${g.sampleTraceIds[0]}`,
+    ].filter(Boolean).join(' · ');
+    if (meta) console.log(ui.c.dim(`         ${meta}`));
+  }
+  console.log('');
+  console.log(ui.c.dim('  A group\'s requests: securenow logs trace <traceId>   Ask why: securenow forensics chat --app <key> "<question>"'));
+  console.log('');
+}
+
 async function logsTrace(args, flags) {
   requireAuth();
   const traceId = args[0];
@@ -499,6 +541,7 @@ module.exports = {
   tracesAnalyze,
   logsList,
   logsTrace,
+  logsErrors,
   notificationsList,
   notificationsRead,
   notificationsReadAll,

package/cli/security.js

@@ -55,6 +55,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'from-text' || sub === 'draft') {
     return alertRuleFromText(args.slice(1), flags);
   }
+  if (sub === 'change') {
+    return alertRuleChange(args.slice(1), flags);
+  }
   if (sub === 'show') {
     return alertRuleShow(args.slice(1), flags);
   }
@@ -94,6 +97,9 @@ async function alertRulesRoute(args, flags) {
   if (sub === 'runs') {
     return alertRuleRuns(args.slice(1), flags);
   }
+  if (sub === 'request-promotion') {
+    return alertRuleRequestPromotion(args.slice(1), flags);
+  }
   if (sub === 'run' || sub === 'run-now') {
     return alertRuleRunNow(args.slice(1), flags);
   }
@@ -472,9 +478,14 @@ async function alertRuleUpdate(args, flags) {
 
   // Lifecycle mode promote/demote (also available as: alerts rules promote|demote <id>).
   if (flags.mode === 'test' || flags.mode === 'prod') body.mode = flags.mode;
+  if (flags.severity) {
+    const severity = String(flags.severity).toLowerCase();
+    if (!['critical', 'high', 'medium', 'low'].includes(severity)) { ui.error('--severity must be critical, high, medium or low'); process.exit(1); }
+    body.severity = severity;
+  }
 
   if (Object.keys(body).length === 0) {
-    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), or --mode test|prod (or: alerts rules promote/demote <id>).');
+    ui.error('Nothing to update. Use --applications-all/--apps, --status (or --enable/--disable/--pause), --severity, or --mode test|prod (or: alerts rules promote/demote <id>).');
     process.exit(1);
   }
 
@@ -482,7 +493,7 @@ async function alertRuleUpdate(args, flags) {
   try {
     await api.put(`/alert-rules/${id}`, body);
     s.stop('Updated');
-    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`].filter(Boolean);
+    const extras = [body.status && `status → ${body.status}`, body.mode && `mode → ${body.mode}`, body.severity && `severity → ${body.severity}`].filter(Boolean);
     ui.success('Alert rule updated' + (extras.length ? ` (${extras.join(', ')})` : ''));
   } catch (err) {
     s.fail('Failed to update alert rule');
@@ -873,6 +884,87 @@ async function alertRuleFromText(args, flags) {
   console.log(ui.c.dim(`  Runs: securenow alerts rules runs ${id}   Why no alert: securenow alerts rules why ${id} --ip <ip>`));
 }
 
+// Describe a change to an existing rule in English: the API rewrites the rule from its current
+// version and the app's data, checks the result, and the change is applied as a new rule version.
+async function alertRuleChange(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const text = args.slice(1).join(' ').trim() || (typeof flags.text === 'string' ? flags.text.trim() : '');
+  if (!id || !text) {
+    ui.error('Usage: securenow alerts rules change <rule-id> "<what should change>" [--app <key>] [--yes] [--draft-only] [--json]');
+    console.log(ui.c.dim('  Example: securenow alerts rules change <id> "raise the threshold to 20 failed sign-ins"'));
+    process.exit(1);
+  }
+  const body = { text, ruleId: id };
+  if (flags.app) body.applicationKey = flags.app;
+
+  const s = ui.spinner('Rewriting the rule from your app\'s data');
+  let result;
+  try {
+    const started = await api.post('/alert-rules/draft', body);
+    result = await waitForDraft(started.draftId, s);
+  } catch (err) {
+    s.fail('Failed to draft the change');
+    throw err;
+  }
+  if (result.status !== 'complete') {
+    s.fail(result.error || 'Could not draft the change');
+    process.exit(1);
+  }
+  s.stop('Change drafted');
+
+  const matches = Number(result.check?.matches || 0);
+  const refuse = Boolean(flags.yes) && !flags.force && !flags['draft-only'] && matches > 0;
+  if (flags.json && (flags['draft-only'] || !flags.yes)) { ui.json(result); return; }
+  if (flags.json && refuse) {
+    ui.json({ ...result, applied: false, refused: 'check_matches' });
+    process.exit(1);
+  }
+  if (result.current?.kind === 'instant') {
+    console.log('');
+    console.log(ui.c.dim(`  Before: ${result.current.matchMode === 'all' ? 'all of' : 'any of'} ${(result.current.conditions || []).map((c) => `${c.field} ${c.operator} ${c.value}`).join('; ')}`));
+  } else if (result.current?.sql) {
+    console.log('');
+    console.log(ui.c.dim('  Before'));
+    for (const line of String(result.current.sql).split('\n')) console.log(ui.c.dim(`    ${line}`));
+  }
+  printDraft(result);
+  console.log('');
+  if (flags['draft-only']) { ui.info('Draft only: nothing was changed.'); return; }
+  if (refuse) {
+    ui.warn(`Not applied: the changed rule matches ${matches} row${matches === 1 ? '' : 's'} in your data right now, so it would alert at once. Apply anyway with --yes --force.`);
+    process.exit(1);
+  }
+  if (!flags.yes) {
+    if (matches > 0) ui.warn(`The changed rule matches ${matches} row${matches === 1 ? '' : 's'} right now (above): it alerts as soon as it is applied.`);
+    const ok = await ui.confirm('Apply this change? It is saved as a new rule version (roll back with alerts rules rollback)');
+    if (!ok) { ui.info('Nothing changed'); return; }
+  }
+
+  const d = result.draft || {};
+  const update = {
+    name: d.name,
+    description: d.summary || undefined,
+    severity: d.severity,
+    reviewNote: `Changed in English: ${text}`.slice(0, 1000),
+    // Instant: only what the draft decides, so the rule keeps its own instant-block settings.
+    ...(d.executionMode === 'instant'
+      ? { instant: { matchMode: d.instant?.matchMode, conditions: d.instant?.conditions || [], environments: d.instant?.environments || [] } }
+      : { sqlQuery: d.sqlQuery, schedule: d.schedule }),
+  };
+  const c = ui.spinner('Applying the change');
+  try {
+    const data = await api.put(`/alert-rules/${id}`, update);
+    c.stop(`Changed: version ${data.configVersion || '?'}`);
+    printWarnings(data);
+    if (flags.json) ui.json(data);
+    else console.log(ui.c.dim(`  History: securenow alerts rules versions ${id}   Runs: securenow alerts rules runs ${id}`));
+  } catch (err) {
+    c.fail('Failed to apply the change');
+    throw err;
+  }
+}
+
 async function alertRuleTest(args, flags) {
   requireAuth();
   const id = args[0];
@@ -1230,6 +1322,33 @@ async function alertRuleWhy(args, flags) {
   console.log('');
 }
 
+// An agent hands the promotion of its test-mode rule to a person: the request waits on the rules
+// page and in `securenow human promotions` until someone approves or denies it.
+async function alertRuleRequestPromotion(args, flags) {
+  requireAuth();
+  const id = args[0];
+  const reason = typeof flags.reason === 'string' ? flags.reason.trim() : '';
+  if (!id || !reason) {
+    ui.error('Usage: securenow alerts rules request-promotion <rule-id> --reason "why it is ready for prod" [--evidence "<text>|@file"]');
+    process.exit(1);
+  }
+  const body = { reason };
+  if (typeof flags.evidence === 'string') {
+    body.evidence = flags.evidence.startsWith('@') ? fs.readFileSync(flags.evidence.slice(1), 'utf8') : flags.evidence;
+  }
+  const s = ui.spinner('Asking for promotion');
+  try {
+    const data = await api.post(`/alert-rules/${id}/promotion-requests`, body);
+    s.stop(data.existing ? 'A request for this rule is already waiting' : 'Promotion requested');
+    if (flags.json) { ui.json(data); return; }
+    ui.info(data.message || 'Waiting for a person to approve it.');
+    if (data.request?.id) console.log(ui.c.dim(`  Request ${data.request.id}. A person decides with: securenow human promotions`));
+  } catch (err) {
+    s.fail('Failed to request promotion');
+    throw err;
+  }
+}
+
 // ── Alert Channels ──
 
 function channelDestination(ch) {

package/cli.js

@@ -195,6 +195,7 @@ const COMMANDS = {
     sub: {
       list: { desc: 'List recent logs', flags: { app: 'App key', env: 'Environment (production, staging, preview, local, or all)', environment: 'Alias for --env', limit: 'Max results (default 200)', since: 'Time window (e.g. 30m, 6h, 2d)', minutes: 'Time window in minutes (alias for --since Nm)', level: 'Filter by level (error, warn, info, debug)', start: 'Start time (ISO 8601)', end: 'End time (ISO 8601)' }, run: (a, f) => require('./cli/monitor').logsList(a, f) },
       trace: { desc: 'Show logs for a trace', usage: 'securenow logs trace <traceId>', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env' }, run: (a, f) => require('./cli/monitor').logsTrace(a, f) },
+      errors: { desc: 'Error lines grouped by message (ids and numbers normalized), most frequent first', usage: 'securenow logs errors [--app <key>] [--env <env>] [--since 1h] [--warn] [--limit 20]', flags: { app: 'App key', env: 'Environment', environment: 'Alias for --env', since: 'Window, e.g. 30m, 6h, 2d (default 1h)', warn: 'Include warnings', limit: 'Max groups (default 20)', json: 'Output as JSON' }, run: (a, f) => require('./cli/monitor').logsErrors(a, f) },
     },
     defaultSub: 'list',
   },
@@ -249,9 +250,10 @@ const COMMANDS = {
   },
   human: {
     desc: 'Work the human action queue prepared by SecureNow AI',
-    usage: 'securenow human <list|show|block|fp|report|action|prompt|work> [row|notificationId:ip] [options]',
+    usage: 'securenow human <list|show|block|fp|report|action|prompt|work|promotions|approve-promotion|deny-promotion> [row|notificationId:ip|request-id] [options]',
     flags: {
       json: 'Output as JSON',
+      note: 'With approve-promotion / deny-promotion: a note recorded with the decision',
       page: 'Queue page number',
       limit: 'Queue page size',
       search: 'Search IP, rule, path, or verdict',
@@ -286,6 +288,9 @@ const COMMANDS = {
       action: { desc: 'Approve/reject/execute a case-level proposed action', usage: 'securenow human action <row|notificationId> [actionKey] --status approved --yes --reason "..."', run: (a, f) => require('./cli/human').action(a, f) },
       prompt: { desc: 'Print a Codex/Claude MCP prompt for row or queue work', usage: 'securenow human prompt [row|notificationId:ip] [--limit 10]', run: (a, f) => require('./cli/human').prompt(a, f) },
       work: { desc: 'List the queue and print the MCP runbook to work it deeply', usage: 'securenow human work [--limit 10]', run: (a, f) => require('./cli/human').work(a, f) },
+      promotions: { desc: 'List requests to promote a test-mode rule to prod (agents ask, a person decides)', usage: 'securenow human promotions [--status pending|approved|denied|all]', run: (a, f) => require('./cli/human').promotions(a, f) },
+      'approve-promotion': { desc: 'Approve a promotion request: the rule goes to prod', usage: 'securenow human approve-promotion <request-id> --yes [--note "..."]', run: (a, f) => require('./cli/human').approvePromotion(a, f) },
+      'deny-promotion': { desc: 'Deny a promotion request: the rule stays in test mode', usage: 'securenow human deny-promotion <request-id> --reason "..."', run: (a, f) => require('./cli/human').denyPromotion(a, f) },
     },
     defaultSub: 'list',
   },
@@ -314,9 +319,11 @@ const COMMANDS = {
         desc: 'Create (from English or SQL), list, show, update, duplicate, promote/demote, set-sql, validate, delete, test, run, explain, or tune alert rules',
         usage: 'securenow alerts rules <list|from-text|create|show|update|duplicate|promote|demote|set-sql|validate|delete|test|run|runs|why|dry-run-query|tune-query|exclusions|versions|version|rollback> [options]\n'
           + '  securenow alerts rules from-text "<what to catch, in English>" --app <key> [--env <environment>] [--instant|--periodic] [--yes|--draft-only]\n'
+          + '  securenow alerts rules change <id> "<what should change>" [--yes|--draft-only]   rewrite a rule from English, checked, applied as a new version\n'
           + '  securenow alerts rules runs <id> [--limit 20] [--since 1h]     what each run saw and why it did or didn\'t notify\n'
           + '  securenow alerts rules run <id> [--no-wait]                     run a periodic rule now\n'
-          + '  securenow alerts rules why <id> --ip <ip> [--since 1h]          why the rule did or didn\'t alert on one address',
+          + '  securenow alerts rules why <id> --ip <ip> [--since 1h]          why the rule did or didn\'t alert on one address\n'
+          + '  securenow alerts rules request-promotion <id> --reason "..."    ask a person to promote a test-mode rule (for agents)',
         flags: {
           json: 'Output as JSON',
           env: 'With from-text or create --conditions: only watch this environment (default: every environment)',
@@ -330,7 +337,7 @@ const COMMANDS = {
           nlp: 'With create: plain-English intent stored on the query',
           text: 'Alias for --nlp',
           category: 'With create: query category (default: custom)',
-          severity: 'With create: critical | high | medium | low',
+          severity: 'With create/update: critical | high | medium | low',
           schedule: 'With create: cron expression (default */15 * * * *)',
           'throttle-minutes': 'With create: one alert per address every N minutes (default 15)',
           'no-throttle': 'With create: disable throttling',
@@ -359,7 +366,8 @@ const COMMANDS = {
           query: 'Alias for --sql',
           file: 'Read SQL from a file',
           'no-validate': 'With create/set-sql: skip the post-write dry-run + rollback',
-          reason: 'Audit reason for a write',
+          reason: 'Audit reason for a write. With request-promotion: why the rule is ready for prod',
+          evidence: 'With request-promotion: evidence text or @file (runs, notifications, false-positive checks)',
           'apply-globally': 'Required for system query tuning',
           'reactivate-paused': 'Reactivate paused system copies after tuning',
           'expected-hash': 'Expected current SQL SHA-256 hash',
@@ -775,8 +783,14 @@ const COMMANDS = {
   },
   mcp: {
     desc: 'Start the SecureNow MCP server over stdio',
-    usage: 'securenow mcp',
-    run: () => require('./mcp/server'),
+    usage: 'securenow mcp [--profile all|investigator|detection|responder]',
+    flags: {
+      profile: 'Serve a subset of the tools: investigator (read-only investigation), detection (alert rules), responder (alerts, blocks, limits). Default: all',
+    },
+    run: (a, f) => {
+      if (typeof f.profile === 'string') process.env.SECURENOW_MCP_PROFILE = f.profile;
+      require('./mcp/server');
+    },
   },
   version: {
     desc: 'Show CLI version',

package/esm-detect.js

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * Is this an ESM app, so the preload must register the ESM loader hook?
+ *
+ * Node decides a file's module type from the nearest package.json above THE FILE, not from
+ * the working directory. Process managers often start apps from another directory (pm2 `cwd`,
+ * systemd WorkingDirectory, a Docker WORKDIR, a supervisor that runs each environment from its
+ * own folder). Checking only process.cwd() then missed the hook, and every library the app
+ * imports (Express, pg, ...) went uninstrumented: no http.route on any request span.
+ *
+ * ESM when any of these says so: the entry script is .mjs; the nearest package.json above the
+ * entry script (process.argv[1], or pm2's pm_exec_path) has "type": "module"; or the working
+ * directory's package.json does (the original check, kept for launchers whose argv[1] is a wrapper).
+ */
+const fs = require('fs');
+const path = require('path');
+
+function readType(pkgPath) {
+  try {
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^/, '')).type || 'commonjs';
+  } catch (_) {
+    return null;
+  }
+}
+
+function nearestPackageJson(startDir) {
+  let dir = startDir;
+  for (let i = 0; i < 64; i++) {
+    const candidate = path.join(dir, 'package.json');
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+
+/** @returns {{ esm: boolean, reason: string|null }} */
+function detectEsmApp({ argv = process.argv, cwd = process.cwd(), env = process.env } = {}) {
+  const entries = [argv && argv[1], env && env.pm_exec_path]
+    .filter((p) => typeof p === 'string' && p && !p.startsWith('-'))
+    .map((p) => path.resolve(cwd, p));
+
+  for (const entry of entries) {
+    if (/\.mjs$/i.test(entry)) return { esm: true, reason: `${path.basename(entry)} is an .mjs file` };
+    if (/\.cjs$/i.test(entry)) continue;
+    const pkgPath = nearestPackageJson(path.dirname(entry));
+    if (pkgPath && readType(pkgPath) === 'module') return { esm: true, reason: `${pkgPath} has "type": "module"` };
+  }
+
+  const cwdPkg = path.resolve(cwd, 'package.json');
+  if (fs.existsSync(cwdPkg) && readType(cwdPkg) === 'module') return { esm: true, reason: `${cwdPkg} has "type": "module"` };
+  return { esm: false, reason: null };
+}
+
+module.exports = { detectEsmApp, nearestPackageJson };

package/mcp/catalog.js

@@ -353,7 +353,7 @@ const TOOLS = [
   {
     name: 'securenow_traces_show',
     title: 'Show Trace',
-    description: 'Show spans for a trace id scoped to one or more app keys.',
+    description: 'Show spans for a trace id scoped to one or more app keys. Fields identical on every span (service, environment and other resource attributes) come once under shared; empty fields are left out.',
     scope: 'traces:read',
     readOnly: true,
     method: 'GET',
@@ -385,6 +385,25 @@ const TOOLS = [
       limit: number('Maximum logs to return.', { minimum: 1, maximum: 500 }),
     }, ['appKeys']),
   },
+  {
+    name: 'securenow_logs_errors',
+    title: 'Summarize Error Logs',
+    description: 'What is failing: error (and fatal) log lines grouped by message, with ids, uuids, IPs and numbers normalized so repeats are one group. Each group: a sample line, how many times, first and last seen, environments, exception type and sample trace ids (pass one to securenow_logs_for_trace or securenow_traces_show). Far cheaper than listing raw logs. includeWarn adds warnings.',
+    scope: 'logs:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/logs/errors',
+    queryFields: ['appKeys', 'environment', 'since', 'from', 'to', 'includeWarn', 'limit'],
+    normalize: { appKeys: normalizeAppKeys },
+    inputSchema: objectSchema({
+      ...appKeysInput,
+      ...environmentInput,
+      since: string('Window: 30m, 1h (default), 6h, 2d; or pass from/to.'),
+      ...timeRangeInput,
+      includeWarn: boolean('Also group warnings.'),
+      limit: number('Maximum groups (default 20).', { minimum: 1, maximum: 100 }),
+    }, ['appKeys']),
+  },
   {
     name: 'securenow_logs_for_trace',
     title: 'Logs For Trace',
@@ -1381,13 +1400,13 @@ const TOOLS = [
   {
     name: 'securenow_alert_rule_draft',
     title: 'Draft an Alert Rule From English',
-    description: 'Turn a detection idea in plain English into an alert rule draft for one app, checked against that app\'s data. It reads the app\'s real event types, attribute keys and routes, then picks the kind: instant (conditions checked on every incoming request, alerts within seconds; one request is enough evidence) or periodic (SQL run on a schedule: counts, thresholds, distinct counts, ratios, sequences, baselines, security events, app log lines). Periodic SQL is run once against the data; instant conditions are replayed over the app\'s last 2000 requests, so check.matches shows what would alert today (false positives). Nothing is saved: create it with securenow_alert_rule_create, passing the draft fields. Waits up to 120 seconds.',
+    description: 'Turn a detection idea in plain English into an alert rule draft for one app, checked against that app\'s data. It reads the app\'s real event types, attribute keys and routes, then picks the kind: instant (conditions checked on every incoming request, alerts within seconds; one request is enough evidence) or periodic (SQL run on a schedule: counts, thresholds, distinct counts, ratios, sequences, baselines, security events, app log lines). Periodic SQL is run once against the data; instant conditions are replayed over the app\'s last 2000 requests, so check.matches shows what would alert today (false positives). Nothing is saved: create it with securenow_alert_rule_create, passing the draft fields. To CHANGE an existing rule, pass ruleId and describe the change in text: the draft is the whole rule rewritten (same kind, the rest kept), with `current` showing the rule as it is; apply it with securenow_alert_rule_update (sqlQuery + schedule, or instant {matchMode, conditions, environments}). Waits up to 120 seconds.',
     scope: 'alerts:write',
     readOnly: false,
     confirm: true,
     method: 'POST',
     endpoint: '/alert-rules/draft',
-    bodyFields: ['text', 'applicationKey', 'environment', 'kind'],
+    bodyFields: ['text', 'applicationKey', 'environment', 'kind', 'ruleId'],
     poll: {
       tool: 'securenow_alert_rule_draft_status',
       idField: 'draftId',
@@ -1400,8 +1419,9 @@ const TOOLS = [
       applicationKey: string('App key the rule watches; the draft is checked against its data.'),
       environment: string('Only watch this environment (e.g. production). Omit to watch every environment.'),
       kind: string('Optional: instant or periodic. Omit to let the drafter choose.'),
+      ruleId: string('Optional: an existing custom rule to change; text then describes the change. applicationKey defaults to one the rule watches.'),
       ...confirmSchema,
-    }, ['text', 'applicationKey', 'confirm', 'reason']),
+    }, ['text', 'confirm', 'reason']),
   },
   {
     name: 'securenow_alert_rule_draft_status',
@@ -1521,23 +1541,26 @@ const TOOLS = [
   {
     name: 'securenow_alert_rule_update',
     title: 'Update Alert Rule',
-    description: 'Update alert rule scope/status/schedule/throttle or record a review action. Write action; requires confirmation.',
+    description: 'Update alert rule scope/status/severity/schedule/throttle, a custom rule\'s SQL (sqlQuery, checked like create: scoped, time-bounded, with an ip column) or instant conditions (instant: {matchMode, conditions, environments}; omitted fields such as the instant block stay as they are), or record a review action. reviewNote is kept as the version\'s reason. Write action; requires confirmation.',
     scope: 'alerts:write',
     readOnly: false,
     confirm: true,
     method: 'PUT',
     endpoint: '/alert-rules/:id',
     pathParams: ['id'],
-    bodyFields: ['name', 'description', 'status', 'applicationsAll', 'applications', 'schedule', 'throttle', 'alertChannelIds', 'reviewAction', 'reviewNote', 'reviewNotificationId'],
+    bodyFields: ['name', 'description', 'severity', 'status', 'applicationsAll', 'applications', 'schedule', 'throttle', 'sqlQuery', 'instant', 'alertChannelIds', 'reviewAction', 'reviewNote', 'reviewNotificationId'],
     inputSchema: objectSchema({
       id: string('Alert rule id.'),
       name: string('Rule name for custom rules.'),
       description: string('Rule description for custom rules.'),
+      severity: string('critical, high, medium or low (custom rules).'),
       status: string('Active, Disabled, or Paused.'),
       applicationsAll: boolean('Scope rule to all applications.'),
       applications: arrayOfStrings('Application keys when applicationsAll is false.'),
       schedule: { type: 'object', additionalProperties: true, description: 'Schedule patch.' },
       throttle: { type: 'object', additionalProperties: true, description: 'Throttle patch {enabled, minutes}: one alert per address every N minutes.' },
+      sqlQuery: string('Custom periodic rules: the replacement detection SELECT (e.g. from a securenow_alert_rule_draft with ruleId).'),
+      instant: { type: 'object', additionalProperties: true, description: 'Custom instant rules: {matchMode, conditions: [{field, operator, value}], environments}. Fields left out keep their current values.' },
       alertChannelIds: arrayOfStrings('Alert channel ids.'),
       reviewAction: string('Rule review action: keep_active (keep it running and stop auto-pausing it) or tuned_version (the rule was tuned; resume it).'),
       reviewNote: string('Review note.'),
@@ -1928,6 +1951,37 @@ const TOOLS = [
       since: string('Window start: 30m, 1h (default), 2d or an ISO date; at most 7 days.'),
     }, ['id', 'ip']),
   },
+  {
+    name: 'securenow_alert_rule_request_promotion',
+    title: 'Ask a Person to Promote an Alert Rule',
+    description: 'Ask a person to promote a test-mode rule to prod, with why it is ready and the evidence (runs, notifications it caught, false-positive checks). Agents create rules in test mode and cannot approve this themselves: a person approves on the rules page or with `securenow human approve-promotion`, which moves the rule to prod (its instant block, matching automations and the AI pipeline can then act on its alerts). One pending request per rule. Write action; requires confirmation.',
+    scope: 'alerts:write',
+    readOnly: false,
+    confirm: true,
+    method: 'POST',
+    endpoint: '/alert-rules/:id/promotion-requests',
+    pathParams: ['id'],
+    bodyFields: ['reason', 'evidence'],
+    inputSchema: objectSchema({
+      id: string('Alert rule id (a custom rule in test mode).'),
+      evidence: string('What shows it is ready: e.g. runs and their outcomes, notifications it raised on real attacks, how many false positives in how long.'),
+      ...confirmSchema,
+    }, ['id', 'confirm', 'reason']),
+  },
+  {
+    name: 'securenow_alert_rule_promotion_requests',
+    title: 'List Alert Rule Promotion Requests',
+    description: 'Requests to promote test-mode rules to prod and their status (pending, approved, denied), who asked and why, and who decided.',
+    scope: 'alerts:read',
+    readOnly: true,
+    method: 'GET',
+    endpoint: '/alert-rules/promotion-requests',
+    queryFields: ['status', 'limit'],
+    inputSchema: objectSchema({
+      status: string('pending (default), approved, denied or all.'),
+      limit: number('How many (default 50, max 100).', { minimum: 1, maximum: 100 }),
+    }),
+  },
   {
     name: 'securenow_alert_rule_exclusions_list',
     title: 'List Alert Rule Exclusions',
@@ -2704,8 +2758,40 @@ function mcpToolDefinition(tool) {
   };
 }
 
-function listTools() {
-  return TOOLS.map(mcpToolDefinition);
+// Tool profiles: a smaller tool list for an agent that does one job (fewer tools, less context).
+// Every profile keeps the auth and app tools. `securenow mcp --profile <name>` (or
+// SECURENOW_MCP_PROFILE) picks one; the default is every tool.
+const PROFILE_BASE_TOOLS = new Set(['securenow_auth_status', 'securenow_apps_list', 'securenow_apps_info']);
+const TOOL_PROFILES = {
+  investigator: {
+    description: 'Read-only investigation: notifications, traces, logs, IP intelligence, forensics questions and chat, rule run history and "why didn\'t this alert".',
+    includes: (tool) => tool.readOnly || /^securenow_forensics_(query|chat|chat_confirm)$/.test(tool.name),
+  },
+  detection: {
+    description: 'Write and tune detections: draft, create, test, run and explain alert rules, with the traces, logs, notifications and forensics to check them against.',
+    includes: (tool) => /^securenow_alert_rules?_/.test(tool.name)
+      || /^securenow_(traces|logs|forensics|ip)_/.test(tool.name)
+      || /^securenow_notifications_(list|get|batch_get)$/.test(tool.name),
+  },
+  responder: {
+    description: 'Respond to alerts: notifications, the human action queue and alert reviews, blocks, allowlist, trusted IPs, rate limits, challenges, automations, firewall and IP intelligence.',
+    includes: (tool) => /^securenow_(notifications|human|alert_review|blocklist|allowlist|trusted|rate_limit|challenge|automation|ip|firewall)_/.test(tool.name)
+      || ['securenow_alert_rule_get', 'securenow_alert_rule_runs', 'securenow_alert_rule_explain', 'securenow_traces_list', 'securenow_traces_show', 'securenow_logs_for_trace'].includes(tool.name),
+  },
+};
+
+function toolsForProfile(profile) {
+  const name = String(profile || 'all').trim().toLowerCase();
+  if (name === 'all') return TOOLS;
+  const selected = TOOL_PROFILES[name];
+  if (!selected) {
+    throw new Error(`Unknown MCP profile "${profile}". Use one of: all, ${Object.keys(TOOL_PROFILES).join(', ')}`);
+  }
+  return TOOLS.filter((tool) => PROFILE_BASE_TOOLS.has(tool.name) || selected.includes(tool));
+}
+
+function listTools(profile) {
+  return toolsForProfile(profile).map(mcpToolDefinition);
 }
 
 function listResources() {
@@ -2945,7 +3031,29 @@ function summarizeRateLimit(r) {
   return { ...r, metadata: undefined, effectiveStatus: r.status === 'active' && expired ? 'expired' : r.status };
 }
 
+// One trace's spans repeat the same resource fields (service, environment, SDK...) on every span:
+// keep those once under `shared` and drop empty fields, so a trace costs far less context.
+function compactSpans(res) {
+  if (!Array.isArray(res?.spans) || res.spans.length < 2) return res;
+  const spans = res.spans;
+  const isEmpty = (v) => v == null || v === '' || (typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length === 0)
+    || (Array.isArray(v) && v.length === 0);
+  const shared = {};
+  for (const key of new Set(spans.flatMap((span) => Object.keys(span || {})))) {
+    const first = JSON.stringify(spans[0]?.[key]);
+    if (spans.every((span) => JSON.stringify(span?.[key]) === first)) shared[key] = spans[0]?.[key];
+  }
+  const keep = (span) => Object.fromEntries(Object.entries(span || {}).filter(([key, value]) => !(key in shared) && !isEmpty(value)));
+  return {
+    ...res,
+    _compact: 'Fields identical on every span are listed once under shared; empty fields are left out.',
+    shared: Object.fromEntries(Object.entries(shared).filter(([, value]) => !isEmpty(value))),
+    spans: spans.map(keep),
+  };
+}
+
 const SUMMARIZERS = {
+  securenow_traces_show: compactSpans,
   securenow_notifications_list: (res) => (Array.isArray(res?.notifications) ? { ...res, notifications: res.notifications.map(summarizeNotification) } : res),
   securenow_alert_rules_list: (res) => {
     if (!Array.isArray(res?.alertRules)) return res;
@@ -3000,6 +3108,8 @@ module.exports = {
   getTool,
   mcpToolDefinition,
   listTools,
+  toolsForProfile,
+  TOOL_PROFILES,
   listResources,
   listPrompts,
   promptMessages,

package/mcp/server.js

@@ -9,6 +9,7 @@ const {
   RESOURCES,
   getTool,
   listTools,
+  toolsForProfile,
   listResources,
   listPrompts,
   promptMessages,
@@ -26,6 +27,17 @@ const {
 const SERVER_NAME = 'securenow';
 const PROTOCOL_VERSION = '2025-06-18';
 
+// `securenow mcp --profile investigator|detection|responder` (or SECURENOW_MCP_PROFILE) serves a
+// subset of the tools; the default is every tool.
+const PROFILE = String(process.env.SECURENOW_MCP_PROFILE || 'all').trim().toLowerCase() || 'all';
+let PROFILE_TOOL_NAMES;
+try {
+  PROFILE_TOOL_NAMES = new Set(toolsForProfile(PROFILE).map((tool) => tool.name));
+} catch (err) {
+  process.stderr.write(`[securenow mcp] ${err.message}\n`);
+  process.exit(2);
+}
+
 function write(message) {
   process.stdout.write(`${JSON.stringify(message)}\n`);
 }
@@ -201,7 +213,7 @@ function readResource(uri) {
 
   const text = resourceContent(resource, {
     projectConfig: () => jsonText(localAuthStatus()),
-    toolsCatalog: () => jsonText(listTools().map((tool) => ({
+    toolsCatalog: () => jsonText(listTools(PROFILE).map((tool) => ({
       name: tool.name,
       description: tool.description,
       readOnly: tool.annotations?.readOnlyHint === true,
@@ -240,7 +252,7 @@ async function handleRequest(message) {
     }
 
     if (method === 'ping') return ok(id, {});
-    if (method === 'tools/list') return ok(id, { tools: listTools() });
+    if (method === 'tools/list') return ok(id, { tools: listTools(PROFILE) });
     if (method === 'resources/list') return ok(id, { resources: listResources() });
     if (method === 'prompts/list') return ok(id, { prompts: listPrompts() });
 
@@ -262,6 +274,9 @@ async function handleRequest(message) {
       const args = params.arguments || {};
       const tool = getTool(name);
       if (!tool) throw new Error(`Unknown tool: ${name}`);
+      if (!PROFILE_TOOL_NAMES.has(name)) {
+        throw new Error(`Tool ${name} is not in the "${PROFILE}" MCP profile. Restart the server without --profile (or with another profile) to use it.`);
+      }
 
       const result = await callApiTool(tool, args);
       return ok(id, asToolResult({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.17.0",
+  "version": "8.18.0",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
@@ -11,7 +11,7 @@
     "securenow-mcp": "mcp/server.js"
   },
   "scripts": {
-    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-package-contents.js"
+    "test": "node test-app-config.js && node test-resolve-ip.js && node test-otel-defaults.js && node test-telemetry.js && node test-legacy-semconv.js && node test-otp-redaction.js && node test-header-redaction.js && node test-firewall-paths.js && node test-rate-limits.js && node test-rate-limit-redis.js && node test-log-format.js && node test-crash-capture.js && node test-sdk-disabled.js && node test-internal-thread.js && node test-esm-detect.js && node test-package-contents.js"
   },
   "keywords": [
     "opentelemetry",
@@ -160,6 +160,7 @@
     "challenge.js",
     "otel-defaults.js",
     "internal-thread.js",
+    "esm-detect.js",
     "legacy-semconv.js",
     "otp-redaction.js",
     "header-redaction.js",

package/register.js

@@ -14,13 +14,9 @@ if (require('./sdk-disabled').sdkDisabled('register')) return;
 // 1. Auto-register the ESM loader hook so customers never need --import
 (() => {
   try {
-    const fs = require('fs');
-    const path = require('path');
-    const pkgPath = path.resolve(process.cwd(), 'package.json');
-    if (!fs.existsSync(pkgPath)) return;
-
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8').replace(/^\uFEFF/, ''));
-    if (pkg.type !== 'module') return;
+    // ESM is decided by the entry script's package.json, not only the working directory's
+    // (process managers often start apps from another directory). See esm-detect.js.
+    if (!require('./esm-detect').detectEsmApp().esm) return;
 
     // Already registered via --import?
     const execArgv = process.execArgv.join(' ');

package/tracing.js

@@ -338,19 +338,13 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
 // (e.g. Node 18, or require('securenow/tracing') called directly without register.js).
 (() => {
   try {
-    const fs = require('fs');
-    const path = require('path');
-    const pkgPath = path.resolve(process.cwd(), 'package.json');
-    if (fs.existsSync(pkgPath)) {
-      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-      if (pkg.type === 'module') {
-        const execArgv = process.execArgv.join(' ');
-        const hasCliHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
-        const hasModuleRegister = typeof require('node:module').register === 'function';
-        if (!hasCliHook && !hasModuleRegister) {
-          console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
-          console.warn('[securenow]    Upgrade to Node >=20.6 (recommended) or add: --import @opentelemetry/instrumentation/hook.mjs');
-        }
+    if (require('./esm-detect').detectEsmApp().esm) {
+      const execArgv = process.execArgv.join(' ');
+      const hasCliHook = execArgv.includes('hook.mjs') || execArgv.includes('import-in-the-middle');
+      const hasModuleRegister = typeof require('node:module').register === 'function';
+      if (!hasCliHook && !hasModuleRegister) {
+        console.warn('[securenow] ⚠️  ESM app detected ("type": "module") but no ESM loader hook available.');
+        console.warn('[securenow]    Upgrade to Node >=20.6 (recommended) or add: --import @opentelemetry/instrumentation/hook.mjs');
       }
     }
   } catch (_) {}