security-mcp 1.0.5 → 1.1.0

package/defaults/evidence-map.json

@@ -122,5 +122,199 @@
     "src/**/tool-router*.ts",
     "src/**/tool*.ts",
     "src/**/agent*.ts"
+  ],
+  "mfa_enforced": [
+    "src/**/mfa*.ts",
+    "src/**/mfa*.js",
+    "src/**/totp*.ts",
+    "src/**/webauthn*.ts",
+    "src/**/passkey*.ts",
+    "src/**/two-factor*.ts",
+    "src/**/2fa*.ts",
+    "infra/**",
+    "terraform/**",
+    "k8s/**"
+  ],
+  "audit_logging_configured": [
+    "src/**/audit*.ts",
+    "src/**/audit*.js",
+    "src/**/logger*.ts",
+    "src/**/logging*.ts",
+    "src/**/log*.ts",
+    "lib/**/audit*.ts",
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**"
+  ],
+  "log_retention_policy": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**",
+    "docs/**",
+    "security/**",
+    ".mcp/**"
+  ],
+  "alerting_configured": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**",
+    "src/**/alert*.ts",
+    "src/**/alarm*.ts",
+    "src/**/monitor*.ts",
+    "src/**/pagerduty*.ts",
+    "src/**/opsgenie*.ts"
+  ],
+  "email_filtering": [
+    "infra/**",
+    "terraform/**",
+    "docs/**",
+    "security/**"
+  ],
+  "public_surface_hardened": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**",
+    "src/**/waf*.ts",
+    "src/**/ddos*.ts",
+    "nginx/**",
+    "caddy/**"
+  ],
+  "rate_limiting_present": [
+    "src/**/rate-limit*.ts",
+    "src/**/rateLimit*.ts",
+    "src/**/throttle*.ts",
+    "src/**/middleware*.ts",
+    "middleware.ts",
+    "middleware.js",
+    "app/api/**",
+    "src/api/**"
+  ],
+  "egress_controls": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**",
+    "src/**/egress*.ts",
+    "src/**/firewall*.ts",
+    "src/**/network*.ts"
+  ],
+  "dlp_configured": [
+    "src/**/dlp*.ts",
+    "src/**/dlp*.js",
+    "src/**/pii*.ts",
+    "src/**/redact*.ts",
+    "src/**/sanitize*.ts",
+    "infra/**",
+    "terraform/**"
+  ],
+  "artifact_signing": [
+    ".github/workflows/**",
+    ".gitlab-ci.yml",
+    "cloudbuild.yaml",
+    "Makefile",
+    "scripts/**",
+    "infra/**",
+    "cosign.pub",
+    "*.pub"
+  ],
+  "hermetic_build_configured": [
+    ".github/workflows/**",
+    ".gitlab-ci.yml",
+    "cloudbuild.yaml",
+    "Makefile",
+    "scripts/**",
+    "BUILD",
+    "BUILD.bazel"
+  ],
+  "ir_playbook_present": [
+    "security/**",
+    "docs/security/**",
+    "runbooks/**",
+    "playbooks/**",
+    ".mcp/**"
+  ],
+  "ir_playbook_tested": [
+    "security/**",
+    "docs/security/**",
+    "runbooks/**",
+    "playbooks/**"
+  ],
+  "network_segmentation": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**"
+  ],
+  "zero_trust_network": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**",
+    "src/**/mtls*.ts",
+    "src/**/spiffe*.ts",
+    "src/**/zero-trust*.ts"
+  ],
+  "backup_encryption": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**"
+  ],
+  "backup_tested": [
+    "docs/**",
+    "security/**",
+    "runbooks/**"
+  ],
+  "dns_monitoring": [
+    "infra/**",
+    "terraform/**"
+  ],
+  "pan_encryption_configured": [
+    "infra/**",
+    "terraform/**",
+    "src/**/payment*.ts",
+    "src/**/card*.ts",
+    "src/**/stripe*.ts",
+    "src/**/braintree*.ts"
+  ],
+  "no_plaintext_pan": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.py",
+    "**/*.go",
+    "**/*.java"
+  ],
+  "input_validation_schema": [
+    "src/**",
+    "app/**",
+    "lib/**",
+    "server/**"
+  ],
+  "output_encoding_present": [
+    "src/**",
+    "app/**",
+    "lib/**"
+  ],
+  "service_account_per_workload": [
+    "infra/**",
+    "terraform/**",
+    "k8s/**",
+    "helm/**"
+  ],
+  "human_in_loop_for_actions": [
+    "ai/**",
+    "src/**/agent*.ts",
+    "src/**/tool*.ts",
+    "src/**/confirm*.ts",
+    "src/**/approval*.ts"
+  ],
+  "input_length_limits": [
+    "src/**",
+    "app/**",
+    "middleware.ts",
+    "middleware.js"
   ]
 }

package/defaults/security-policy.json

@@ -1,6 +1,6 @@
 {
   "name": "security-policy",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Default security gate policy for security-mcp. Copy to .mcp/policies/security-policy.json and customize for your project.",
   "required_checks": {
     "secrets_scan": { "severity_block": ["HIGH", "CRITICAL"] },
@@ -8,6 +8,44 @@
     "sast": { "severity_block": ["CRITICAL"] },
     "iac_scan": { "severity_block": ["HIGH", "CRITICAL"] }
   },
+  "environments": {
+    "dev": {
+      "severity_block": ["CRITICAL"],
+      "required_scanners": ["gitleaks"],
+      "required_checks": ["secrets_scan"],
+      "vulnerability_slas": {
+        "CRITICAL": "7d",
+        "HIGH": "30d",
+        "MEDIUM": "90d",
+        "LOW": "never"
+      }
+    },
+    "staging": {
+      "severity_block": ["HIGH", "CRITICAL"],
+      "required_scanners": ["gitleaks", "semgrep", "osv-scanner"],
+      "required_checks": ["secrets_scan", "dependency_scan", "sast"],
+      "vulnerability_slas": {
+        "CRITICAL": "24h",
+        "HIGH": "7d",
+        "MEDIUM": "30d",
+        "LOW": "90d",
+        "CISA_KEV": "24h"
+      }
+    },
+    "prod": {
+      "severity_block": ["MEDIUM", "HIGH", "CRITICAL"],
+      "required_scanners": ["gitleaks", "semgrep", "osv-scanner", "trivy", "checkov"],
+      "required_checks": ["secrets_scan", "dependency_scan", "sast", "iac_scan"],
+      "vulnerability_slas": {
+        "CRITICAL": "24h",
+        "HIGH": "7d",
+        "MEDIUM": "30d",
+        "LOW": "90d",
+        "CISA_KEV": "24h",
+        "HIGH_EPSS": "48h"
+      }
+    }
+  },
   "requirements": [
     {
       "id": "ZERO_TRUST",
@@ -84,7 +122,8 @@
     "HIGH": "7d",
     "MEDIUM": "30d",
     "LOW": "90d",
-    "CISA_KEV": "24h"
+    "CISA_KEV": "24h",
+    "HIGH_EPSS": "48h"
   },
   "exceptions": {
     "require_ticket": true,

package/dist/cli/index.js

@@ -57,12 +57,14 @@ COMMANDS
   config           Print MCP config JSON for manual editor setup
 
 OPTIONS (install)
-  --claude-code    Write config for Claude Code only
-  --cursor         Write config for Cursor only
-  --vscode         Write config for VS Code only
-  --global         Write to global editor config (default)
+  --claude-code        Write config for Claude Code only
+  --cursor             Write config for Cursor only
+  --vscode             Write config for VS Code only
+  --global             Write to global editor config (default)
   --use-global-binary  Write configs that execute "security-mcp serve" instead of npx
-  --dry-run        Print what would change without writing
+  --dry-run            Print what would change without writing
+  --yes                Skip interactive setup questions (install with defaults)
+  --non-interactive    Same as --yes (for CI environments)
 
 OPTIONS (general)
   --version        Print version
@@ -131,26 +133,29 @@ async function main() {
             break;
         }
         case "install": {
+            const noEditorFlag = !args.includes("--claude-code") && !args.includes("--cursor") && !args.includes("--vscode");
             const options = {
                 claudeCode: args.includes("--claude-code"),
                 cursor: args.includes("--cursor"),
                 vscode: args.includes("--vscode"),
                 dryRun: args.includes("--dry-run"),
                 useGlobalBinary,
-                // If no editor flag specified, install to all detected
-                all: !args.includes("--claude-code") && !args.includes("--cursor") && !args.includes("--vscode")
+                all: noEditorFlag,
+                interactive: !args.includes("--yes") && !args.includes("--non-interactive")
             };
             await runInstall(options);
             break;
         }
         case "install-global": {
+            const noEditorFlag = !args.includes("--claude-code") && !args.includes("--cursor") && !args.includes("--vscode");
             const options = {
                 claudeCode: args.includes("--claude-code"),
                 cursor: args.includes("--cursor"),
                 vscode: args.includes("--vscode"),
                 dryRun: args.includes("--dry-run"),
                 useGlobalBinary: true,
-                all: !args.includes("--claude-code") && !args.includes("--cursor") && !args.includes("--vscode")
+                all: noEditorFlag,
+                interactive: !args.includes("--yes") && !args.includes("--non-interactive")
             };
             await runInstall(options);
             break;

package/dist/cli/install.js

@@ -7,6 +7,7 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from
 import { dirname, join, resolve } from "node:path";
 import { homedir, platform } from "node:os";
 import { fileURLToPath } from "node:url";
+import { runOnboarding, installSecurityTools, commandExists, SECURITY_TOOLS } from "./onboarding.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, "../..");
 function resolveHome(p) {
@@ -159,6 +160,16 @@ function installSkill(dryRun) {
 }
 export async function runInstall(opts) {
     const dryRun = opts.dryRun;
+    // ── Interactive onboarding (skipped when --yes or non-TTY) ──────────────
+    if (opts.interactive && !dryRun) {
+        const onboarding = await runOnboarding();
+        if (onboarding?.installTools) {
+            const toInstall = SECURITY_TOOLS.filter((t) => !commandExists(t.id));
+            process.stdout.write("\nInstalling security scanning tools...\n");
+            await installSecurityTools(toInstall);
+            process.stdout.write("\n");
+        }
+    }
     process.stdout.write(`\nsecurity-mcp installer${dryRun ? " (dry-run)" : ""}\n`);
     process.stdout.write("=".repeat(40) + "\n\n");
     const targets = getEditorTargets(opts);