security-mcp 1.1.3 → 1.3.1

package/dist/gate/checks/required-artifacts.js

@@ -1,7 +1,192 @@
 import fg from "fast-glob";
 import picomatch from "picomatch";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Return true if at least one file matching any of the given glob patterns
+ *  exists on disk. */
+async function anyExists(patterns) {
+    const hits = await fg(patterns, { dot: true });
+    return hits.length > 0;
+}
+/** Return true if any of the changedFiles matches at least one picomatch
+ *  pattern from `patterns`. */
+function anyChanged(changedFiles, patterns) {
+    const matchers = patterns.map((p) => picomatch(p, { dot: true }));
+    return changedFiles.some((f) => matchers.some((m) => m(f)));
+}
+// ---------------------------------------------------------------------------
+// Static check helpers — each returns 0 or 1 Finding(s)
+// ---------------------------------------------------------------------------
+async function checkThreatModel() {
+    const found = await anyExists([
+        ".mcp/threat-model.json",
+        ".mcp/threat-model.md",
+        "docs/threat-model.json",
+        "docs/threat-model.md",
+        "security/threat-model.json",
+        "security/threat-model.md",
+        "**/threat-model.json",
+        "**/threat-model.md"
+    ]);
+    if (found)
+        return [];
+    return [
+        {
+            id: "ARTIFACTS_NO_THREAT_MODEL",
+            title: "No threat model file found in .mcp/, docs/, or security/",
+            severity: "HIGH",
+            evidence: [
+                "Searched for: threat-model.json, threat-model.md under .mcp/, docs/, security/",
+                "No match found."
+            ],
+            requiredActions: [
+                "Create a threat model document (threat-model.json or threat-model.md) in .mcp/, docs/, or security/.",
+                "Include STRIDE analysis, OWASP Top-10 mapping, MITRE ATT&CK mapping, trust boundaries, and data flow diagrams.",
+                "Reference the threat model from your PR description and link it to changed components."
+            ],
+            sla: "7d"
+        }
+    ];
+}
+async function checkSbom() {
+    const found = await anyExists([
+        "**/*.cdx.json",
+        "**/*.spdx",
+        "**/*.spdx.json",
+        "**/sbom.json",
+        "**/sbom.xml",
+        "**/bom.json",
+        "**/bom.xml"
+    ]);
+    if (found)
+        return [];
+    return [
+        {
+            id: "ARTIFACTS_NO_SBOM",
+            title: "No SBOM (Software Bill of Materials) found in repository",
+            severity: "HIGH",
+            evidence: [
+                "Searched for CycloneDX (.cdx.json, bom.json, bom.xml) and SPDX (.spdx, .spdx.json) files.",
+                "No match found."
+            ],
+            requiredActions: [
+                "Generate an SBOM in CycloneDX or SPDX format and commit it to the repository.",
+                "For Node.js: `npx @cyclonedx/cyclonedx-npm --output-file sbom.json`.",
+                "For Python: `cyclonedx-bom -o sbom.json`.",
+                "Automate SBOM generation in CI so it stays current with every dependency change.",
+                "Ensure the SBOM is included in any artifact upload to your registry (SLSA Level 2+)."
+            ],
+            sla: "7d"
+        }
+    ];
+}
+async function checkPentestSignoff(changedFiles) {
+    const triggerPatterns = ["**/*payment*", "**/*auth*", "**/*checkout*", "**/*stripe*"];
+    if (!anyChanged(changedFiles, triggerPatterns))
+        return [];
+    const found = await anyExists([
+        ".mcp/pentest-report*",
+        "security/pentest-report*",
+        ".mcp/*pentest*",
+        "security/*pentest*"
+    ]);
+    if (found)
+        return [];
+    const triggeredFiles = changedFiles.filter((f) => anyChanged([f], triggerPatterns));
+    return [
+        {
+            id: "ARTIFACTS_NO_PENTEST_SIGNOFF",
+            title: "Payment/auth files changed but no pentest report or sign-off found",
+            severity: "MEDIUM",
+            evidence: [
+                `Changed files triggering this check: ${triggeredFiles.slice(0, 10).join(", ")}`,
+                "Searched .mcp/ and security/ for pentest-report* — no match found."
+            ],
+            requiredActions: [
+                "Obtain a pentest sign-off for payment and authentication flows before shipping.",
+                "Place the report as pentest-report-<date>.md (or .pdf) in .mcp/ or security/.",
+                "The report must cover OWASP Top-10 auth/session flaws, insecure direct object references, and PCI DSS requirements 6.3-6.5.",
+                "If a full pentest is not yet complete, document interim risk acceptance with CISO sign-off."
+            ],
+            sla: "30d"
+        }
+    ];
+}
+async function checkRedteamResults(changedFiles) {
+    const triggerPatterns = ["**/*llm*", "**/*openai*", "**/*anthropic*", "**/*langchain*", "**/*rag*"];
+    if (!anyChanged(changedFiles, triggerPatterns))
+        return [];
+    const found = await anyExists([
+        ".mcp/agent-runs/ai-findings*",
+        ".mcp/agent-runs/redteam*",
+        "security/ai-findings*",
+        "security/redteam*",
+        ".mcp/ai-findings*",
+        ".mcp/redteam*"
+    ]);
+    if (found)
+        return [];
+    const triggeredFiles = changedFiles.filter((f) => anyChanged([f], triggerPatterns));
+    return [
+        {
+            id: "ARTIFACTS_NO_REDTEAM_RESULTS",
+            title: "AI/LLM files changed but no AI red team results found",
+            severity: "MEDIUM",
+            evidence: [
+                `Changed files triggering this check: ${triggeredFiles.slice(0, 10).join(", ")}`,
+                "Searched .mcp/agent-runs/ and security/ for ai-findings* or redteam* — no match found."
+            ],
+            requiredActions: [
+                "Run an AI red team exercise covering prompt injection, indirect prompt injection, jailbreak attempts, and data exfiltration via LLM outputs.",
+                "Document results in .mcp/agent-runs/redteam-<date>.md or security/ai-findings-<date>.md.",
+                "Address any HIGH/CRITICAL findings before merging LLM-touching changes.",
+                "Reference OWASP LLM Top 10 (LLM01–LLM10) and MITRE ATLAS tactics."
+            ],
+            sla: "30d"
+        }
+    ];
+}
+async function checkComplianceGap(changedFiles) {
+    const triggerPatterns = ["**/*hipaa*", "**/*pci*", "**/*gdpr*", "**/*compliance*", "**/*policy*"];
+    if (!anyChanged(changedFiles, triggerPatterns))
+        return [];
+    const found = await anyExists([
+        ".mcp/compliance-gap*",
+        ".mcp/compliance-findings*",
+        "security/compliance-gap*",
+        "security/compliance-findings*",
+        "docs/compliance-gap*",
+        "docs/compliance-findings*"
+    ]);
+    if (found)
+        return [];
+    const triggeredFiles = changedFiles.filter((f) => anyChanged([f], triggerPatterns));
+    return [
+        {
+            id: "ARTIFACTS_COMPLIANCE_GAP",
+            title: "Compliance-related files changed but no compliance gap analysis found",
+            severity: "MEDIUM",
+            evidence: [
+                `Changed files triggering this check: ${triggeredFiles.slice(0, 10).join(", ")}`,
+                "Searched .mcp/, security/, and docs/ for compliance-gap* or compliance-findings* — no match found."
+            ],
+            requiredActions: [
+                "Produce a compliance gap analysis document before merging compliance/policy changes.",
+                "Place it as compliance-gap-<date>.md in .mcp/, security/, or docs/.",
+                "The gap analysis must map each changed control to its framework requirement (HIPAA §164, PCI DSS 4.0, GDPR Art. 32, etc.).",
+                "Document any residual risk and obtain sign-off from the compliance owner."
+            ],
+            sla: "30d"
+        }
+    ];
+}
+// ---------------------------------------------------------------------------
+// Main export
+// ---------------------------------------------------------------------------
 export async function checkRequiredArtifacts(opts) {
     const findings = [];
+    // 1. Policy-driven artifacts check (existing behaviour — do not change)
     for (const req of opts.policy.artifacts_required ?? []) {
         const matchers = req.on_changes.map((pattern) => picomatch(pattern, { dot: true }));
         const touched = opts.changedFiles.some((file) => matchers.some((match) => match(file)));
@@ -21,5 +206,14 @@ export async function checkRequiredArtifacts(opts) {
             });
         }
     }
+    // 2–6. Static checks (parallel — order of results is deterministic via spread)
+    const [threatModel, sbom, pentest, redteam, compliance] = await Promise.all([
+        checkThreatModel(),
+        checkSbom(),
+        checkPentestSignoff(opts.changedFiles),
+        checkRedteamResults(opts.changedFiles),
+        checkComplianceGap(opts.changedFiles)
+    ]);
+    findings.push(...threatModel, ...sbom, ...pentest, ...redteam, ...compliance);
     return findings;
 }

package/dist/gate/checks/runtime.js

@@ -1,11 +1,14 @@
 /**
  * Runtime evidence verification.
  * Checks HTTP security headers and TLS configuration against a live target.
+ * Also contains static Dockerfile security analysis.
  */
 import * as dns from "node:dns/promises";
 import * as net from "node:net";
 import * as https from "node:https";
 import * as tls from "node:tls";
+import fg from "fast-glob";
+import { readFileSafe } from "../../repo/fs.js";
 // CWE-918: SSRF guard — block private/link-local/metadata IP ranges
 const PRIVATE_CIDR_PATTERNS = [
     /^127\./, // loopback
@@ -328,3 +331,178 @@ export async function runRuntimeChecks(opts) {
     }
     return findings;
 }
+// ---------------------------------------------------------------------------
+// Static Dockerfile analysis
+// ---------------------------------------------------------------------------
+const DOCKERFILE_GLOBS = ["**/Dockerfile", "**/Dockerfile.*", "**/*.dockerfile"];
+const COMPOSE_GLOBS = ["**/docker-compose*.yml", "**/docker-compose*.yaml"];
+const IGNORE = ["**/node_modules/**", "**/dist/**", "**/.git/**"];
+async function loadDockerfiles() {
+    const paths = await fg(DOCKERFILE_GLOBS, { ignore: IGNORE });
+    const results = [];
+    for (const file of paths) {
+        try {
+            const content = await readFileSafe(file);
+            results.push({ file, content });
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    return results;
+}
+async function loadComposeFiles() {
+    const paths = await fg(COMPOSE_GLOBS, { ignore: IGNORE });
+    const results = [];
+    for (const file of paths) {
+        try {
+            const content = await readFileSafe(file);
+            results.push({ file, content });
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    return results;
+}
+async function checkDockerfileNoUser() {
+    const dockerfiles = await loadDockerfiles();
+    const offending = dockerfiles
+        .filter(({ content }) => {
+        if (!/^FROM\s/m.test(content))
+            return false;
+        // For multi-stage builds the USER directive must appear in the final stage
+        // (after the last FROM). A USER only in an earlier build stage still leaves
+        // the runtime stage running as root.
+        const lines = content.split("\n");
+        let lastFromIdx = -1;
+        lines.forEach((line, idx) => { if (/^FROM\s/i.test(line))
+            lastFromIdx = idx; });
+        return !lines.slice(lastFromIdx).some((l) => /^USER\s/i.test(l));
+    })
+        .map(({ file }) => file)
+        .slice(0, 10);
+    if (offending.length === 0)
+        return [];
+    return [{
+            id: "DOCKER_NO_USER_DIRECTIVE",
+            title: "Dockerfile has no USER directive — container runs all processes as root (CWE-250)",
+            severity: "HIGH",
+            files: offending,
+            requiredActions: [
+                "Add a USER directive to each Dockerfile to run the process as a non-root user.",
+                "Create a dedicated low-privilege user (e.g. RUN adduser --disabled-password appuser) and switch to it before CMD/ENTRYPOINT."
+            ]
+        }];
+}
+async function checkDockerfileAddUrl() {
+    const dockerfiles = await loadDockerfiles();
+    const offending = dockerfiles
+        .filter(({ content }) => /^ADD\s+https?:\/\//m.test(content))
+        .map(({ file }) => file)
+        .slice(0, 10);
+    if (offending.length === 0)
+        return [];
+    return [{
+            id: "DOCKER_ADD_REMOTE_URL",
+            title: "Dockerfile ADD with remote URL — no integrity check, CDN compromise or DNS hijack injects malicious content",
+            severity: "HIGH",
+            files: offending,
+            requiredActions: [
+                "Replace ADD <url> with RUN curl --fail -sSL <url> | sha256sum -c <expected> to verify integrity.",
+                "Prefer COPY over ADD for local files; use a multi-stage build to fetch and verify remote artifacts."
+            ]
+        }];
+}
+async function checkDockerfileSecretsInEnv() {
+    const dockerfiles = await loadDockerfiles();
+    const offending = dockerfiles
+        .filter(({ content }) => 
+    // Match assignment form (ENV KEY=val), legacy space form (ENV KEY val), and
+    // secret as a non-first variable on one line (ENV PORT=3000 DB_PASSWORD=x).
+    // Negative lookbehind ensures keyword is not mid-word (e.g. MONKEY won't match KEY).
+    /^ENV\s+.*(?<![A-Z\d])(?:PASSWORD|SECRET|TOKEN|CREDENTIAL|PRIVATE_KEY|API_KEY|KEY)(?:\s*=|\s+\S)/im.test(content))
+        .map(({ file }) => file)
+        .slice(0, 10);
+    if (offending.length === 0)
+        return [];
+    return [{
+            id: "DOCKER_SECRETS_IN_ENV",
+            title: "Dockerfile ENV instruction contains secret-named variable — credentials baked into image layer, visible in docker inspect",
+            severity: "CRITICAL",
+            files: offending,
+            requiredActions: [
+                "Remove secret values from ENV instructions; inject secrets at runtime via Docker secrets, environment variables passed at container start, or a secrets manager.",
+                "Audit existing image layers with 'docker history --no-trunc' to confirm no secret values are stored."
+            ]
+        }];
+}
+async function checkDockerPrivilegedFlag() {
+    const allGlobs = [
+        ...DOCKERFILE_GLOBS,
+        "**/docker-compose*.yml",
+        "**/docker-compose*.yaml",
+        "**/*.docker-compose.yml"
+    ];
+    const paths = await fg(allGlobs, { ignore: IGNORE });
+    const offending = [];
+    for (const file of paths) {
+        try {
+            const content = await readFileSafe(file);
+            if (/privileged:\s*true|--privileged/.test(content)) {
+                offending.push(file);
+                if (offending.length >= 10)
+                    break;
+            }
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    if (offending.length === 0)
+        return [];
+    return [{
+            id: "DOCKER_PRIVILEGED_FLAG",
+            title: "Container started with --privileged or privileged:true — all Linux capabilities granted, complete isolation disabled",
+            severity: "CRITICAL",
+            files: offending,
+            requiredActions: [
+                "Remove privileged: true and --privileged from all container configurations.",
+                "Grant only the specific Linux capabilities required using the cap_add directive (e.g. NET_ADMIN, SYS_PTRACE)."
+            ]
+        }];
+}
+async function checkDockerSocketMountCompose() {
+    const composeFiles = await loadComposeFiles();
+    const offending = composeFiles
+        .filter(({ content }) => /\/var\/run\/docker\.sock/.test(content))
+        .map(({ file }) => file)
+        .slice(0, 10);
+    if (offending.length === 0)
+        return [];
+    return [{
+            id: "DOCKER_SOCKET_MOUNT",
+            title: "Docker socket mounted into container in docker-compose — full Docker daemon control enables host root escape",
+            severity: "CRITICAL",
+            files: offending,
+            requiredActions: [
+                "Remove /var/run/docker.sock volume mounts from all docker-compose services.",
+                "If Docker-in-Docker is required, use rootless Docker or a dedicated DinD sidecar with a restricted socket proxy (e.g. Tecnativa/docker-socket-proxy)."
+            ]
+        }];
+}
+export async function runDockerChecks(_opts) {
+    const settled = await Promise.allSettled([
+        checkDockerfileNoUser(),
+        checkDockerfileAddUrl(),
+        checkDockerfileSecretsInEnv(),
+        checkDockerPrivilegedFlag(),
+        checkDockerSocketMountCompose()
+    ]);
+    const findings = [];
+    for (const r of settled) {
+        if (r.status === "fulfilled")
+            findings.push(...r.value);
+    }
+    return findings;
+}