security-mcp 1.0.3 → 1.0.5

package/dist/gate/policy.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import fg from "fast-glob";
 import { getChangedFiles } from "./diff.js";
 import { detectSurfaces } from "./findings.js";
 import { checkRequiredArtifacts } from "./checks/required-artifacts.js";
@@ -10,6 +11,10 @@ import { checkInfra } from "./checks/infra.js";
 import { checkMobileIos } from "./checks/mobile-ios.js";
 import { checkMobileAndroid } from "./checks/mobile-android.js";
 import { checkAi } from "./checks/ai.js";
+import { checkScannerReadiness } from "./checks/scanners.js";
+import { evaluateEvidenceCoverage } from "./evidence.js";
+import { applySecurityExceptions } from "./exceptions.js";
+import { controlApplies, loadControlCatalog } from "./catalog.js";
 import { readFileSafe } from "../repo/fs.js";
 const PolicySchema = z.object({
     name: z.string(),
@@ -29,6 +34,43 @@ const PolicySchema = z.object({
     }))
         .default([])
 });
+const SCOPE_IGNORE_GLOBS = ["**/node_modules/**", "**/.git/**", "**/dist/**"];
+const SAFE_SCOPE_TARGET_RE = /^[a-zA-Z0-9_./-]+$/;
+function validateScopeTarget(target) {
+    if (!target || target.includes("..") || target.startsWith("/") || !SAFE_SCOPE_TARGET_RE.test(target)) {
+        throw new Error(`Invalid scope target "${target}". Use a relative file/folder path with alphanumerics, "_", "-", ".", "/".`);
+    }
+}
+function normalizeTargets(targets) {
+    return (targets ?? []).map((t) => t.trim()).filter(Boolean);
+}
+async function resolveScopedFiles(opts) {
+    if (opts.mode === "recent_changes") {
+        return await getChangedFiles({ baseRef: opts.baseRef, headRef: opts.headRef });
+    }
+    const targets = normalizeTargets(opts.targets);
+    if (targets.length === 0) {
+        throw new Error(`Scan mode "${opts.mode}" requires "targets". ` +
+            `Provide one or more relative paths (folders for folder_by_folder, files for file_by_file).`);
+    }
+    for (const target of targets)
+        validateScopeTarget(target);
+    if (opts.mode === "file_by_file") {
+        const files = await fg(targets, {
+            onlyFiles: true,
+            dot: true,
+            ignore: SCOPE_IGNORE_GLOBS
+        });
+        return Array.from(new Set(files)).sort();
+    }
+    const folderGlobs = targets.map((target) => `${target.replace(/\/+$/, "")}/**/*`);
+    const files = await fg(folderGlobs, {
+        onlyFiles: true,
+        dot: true,
+        ignore: SCOPE_IGNORE_GLOBS
+    });
+    return Array.from(new Set(files)).sort();
+}
 export async function loadPolicy(policyPath) {
     const raw = await readFileSafe(policyPath);
     const parsed = JSON.parse(raw);
@@ -36,17 +78,26 @@ export async function loadPolicy(policyPath) {
 }
 export async function runPrGate(opts) {
     const policy = await loadPolicy(opts.policyPath);
-    const changedFiles = await getChangedFiles({
+    const mode = opts.mode ?? "recent_changes";
+    const targets = normalizeTargets(opts.targets);
+    const changedFiles = await resolveScopedFiles({
+        mode,
+        targets,
         baseRef: opts.baseRef ?? "origin/main",
         headRef: opts.headRef ?? "HEAD"
     });
     const surfaces = detectSurfaces(changedFiles);
-    const findings = [
+    const catalog = await loadControlCatalog();
+    const scannerReadiness = await checkScannerReadiness({ surfaces });
+    const evidenceCoverage = await evaluateEvidenceCoverage({ policy, surfaces });
+    const rawFindings = [
         // Required artifacts first: threat models/checklists.
         ...(await checkRequiredArtifacts({ policy, changedFiles })),
         // Baseline scans / checks
         ...(await checkSecrets({ changedFiles })),
         ...(await checkDependencies({ changedFiles })),
+        ...scannerReadiness.findings,
+        ...evidenceCoverage.findings,
         // Surface-specific checks (only run if that surface is impacted or exists)
         ...(surfaces.web ? await checkWebNextjs({ changedFiles }) : []),
         ...(surfaces.api ? await checkApi({ changedFiles }) : []),
@@ -55,6 +106,47 @@ export async function runPrGate(opts) {
         ...(surfaces.mobileAndroid ? await checkMobileAndroid({ changedFiles }) : []),
         ...(surfaces.ai ? await checkAi({ changedFiles }) : [])
     ];
+    const toolingCoverage = catalog.controls
+        .filter((control) => control.automation === "tooling" && controlApplies(control, surfaces))
+        .map((control) => {
+        const required = control.required_scanners ?? [];
+        const missing = required.filter((scannerId) => !scannerReadiness.configured.includes(scannerId) || scannerReadiness.missing.includes(scannerId));
+        return {
+            id: control.id,
+            description: control.description,
+            automation: control.automation,
+            frameworks: control.frameworks,
+            status: missing.length > 0 ? "missing" : "satisfied",
+            details: missing.length > 0 ? missing : required
+        };
+    });
+    const controlCoverage = [
+        ...evidenceCoverage.controls.filter((control) => control.automation === "evidence"),
+        ...toolingCoverage
+    ];
+    const exceptionResult = await applySecurityExceptions(rawFindings);
+    const controlCoverageWithExceptions = controlCoverage.map((control) => {
+        if (exceptionResult.activeControlExceptionIds.includes(control.id) && control.status === "missing") {
+            return {
+                ...control,
+                status: "risk_accepted",
+                details: [...control.details, "Covered by an active approved control exception."]
+            };
+        }
+        return control;
+    });
+    const findings = [...exceptionResult.findings, ...exceptionResult.exceptionFindings];
+    const relevantControls = controlCoverageWithExceptions.filter((control) => control.status !== "not_applicable");
+    const satisfiedControls = relevantControls.filter((control) => control.status === "satisfied").length;
+    const riskAcceptedControls = relevantControls.filter((control) => control.status === "risk_accepted").length;
+    const automatedCoverage = relevantControls.length === 0
+        ? 100
+        : Math.round((((satisfiedControls) + (riskAcceptedControls * 0.5)) / relevantControls.length) * 100);
+    const scannerScore = scannerReadiness.configured.length === 0
+        ? 0
+        : Math.round(((scannerReadiness.configured.length - scannerReadiness.missing.length) / scannerReadiness.configured.length) * 100);
+    const confidenceScore = Math.max(0, Math.min(100, Math.round((automatedCoverage * 0.7) + (scannerScore * 0.3))));
+    const missingControls = relevantControls.filter((control) => control.status === "missing").length;
     const status = findings.some((f) => f.severity === "HIGH" || f.severity === "CRITICAL")
         ? "FAIL"
         : "PASS";
@@ -62,7 +154,21 @@ export async function runPrGate(opts) {
         status,
         policyVersion: policy.version,
         evaluatedAt: new Date().toISOString(),
-        scope: { changedFiles, surfaces },
-        findings
+        scope: { mode, targets, changedFiles, surfaces },
+        findings,
+        suppressedFindings: exceptionResult.suppressed,
+        controlCoverage: controlCoverageWithExceptions,
+        scannerReadiness: {
+            configured: scannerReadiness.configured,
+            missing: scannerReadiness.missing
+        },
+        confidence: {
+            score: confidenceScore,
+            automatedCoverage,
+            missingControls,
+            riskAcceptedControls,
+            scannerReadiness: scannerScore,
+            summary: `Automated coverage ${automatedCoverage}%, scanner readiness ${scannerScore}%, missing controls ${missingControls}, risk-accepted controls ${riskAcceptedControls}.`
+        }
     };
 }