security-mcp 1.1.3 → 1.3.1

package/defaults/checklists/mobile.json

@@ -20,6 +20,28 @@
     { "id": "mobile_threat_model", "description": "Threat model completed and reviewed for this mobile surface change", "critical": true },
     { "id": "mobile_data_residency", "description": "Data residency requirements met — no user data stored on device beyond session", "critical": false },
     { "id": "mobile_backup_prevention", "description": "allowBackup=false in Android manifest — sensitive data not included in backups", "critical": true },
-    { "id": "mobile_logging", "description": "No sensitive data logged in production builds — crash reporting sanitized", "critical": true }
+    { "id": "mobile_logging", "description": "No sensitive data logged in production builds — crash reporting sanitized", "critical": true },
+    { "id": "mobile_tapjacking_prevention", "description": "Android tapjacking prevention: FLAG_SECURE set on sensitive screens; filterTouchesWhenObscured=true on clickable elements handling auth or payments", "critical": true },
+    { "id": "mobile_memory_zeroing", "description": "Sensitive data (passwords, keys, PAN) explicitly zeroed from memory after use — not relying on GC; no sensitive data in String objects (use char[] or SecureString)", "critical": false },
+    { "id": "mobile_anti_debugging", "description": "Anti-debugging and anti-tampering controls in place for high-risk operations; ptrace detection and integrity attestation verified before sensitive operations", "critical": false },
+    { "id": "mobile_ios_temp_sensitive", "title": "iOS: Sensitive data not written to NSTemporaryDirectory or NSCachesDirectory without explicit cleanup", "severity": "high", "automated": true },
+    { "id": "mobile_ios_file_protection_none", "title": "iOS: NSFileProtectionNone not set on any file containing sensitive data", "severity": "critical", "automated": true },
+    { "id": "mobile_ios_appstorage_sensitive", "title": "iOS: @AppStorage not used for sensitive credentials or tokens", "severity": "high", "automated": true },
+    { "id": "mobile_ios_sqlite_unencrypted", "title": "iOS: SQLite databases encrypted with SQLCipher when storing sensitive data", "severity": "high", "automated": true },
+    { "id": "mobile_ios_webview_http", "title": "iOS: WKWebView does not load http:// URLs when JavaScript is enabled", "severity": "critical", "automated": true },
+    { "id": "mobile_ios_universal_links", "title": "iOS: Universal Links configured with HTTPS AASA and restrictive path patterns", "severity": "high", "automated": true },
+    { "id": "mobile_android_root_detection", "title": "Android: Root detection implemented for high-risk operations", "severity": "medium", "automated": true },
+    { "id": "mobile_android_frida_magisk_detection", "title": "Android: Frida/Magisk/Xposed detection in place for high-risk app flows", "severity": "medium", "automated": true },
+    { "id": "mobile_android_webview_ssl_error", "title": "Android: WebViewClient.onReceivedSslError does not call proceed() unconditionally", "severity": "critical", "automated": true },
+    { "id": "mobile_android_firebase_rules", "title": "Android: Firebase Realtime Database and Firestore rules deny unauthenticated access", "severity": "critical", "automated": true },
+    { "id": "mobile_android_maps_api_key", "title": "Android: Google Maps API key not hardcoded in manifest or resource files", "severity": "high", "automated": true },
+    { "id": "mobile_android_deeplink_traversal", "title": "Android: Deep link path parameters validated and sanitized before use in file or URL operations", "severity": "high", "automated": true },
+    { "id": "mobile_android_sharedprefs_world", "title": "Android: SharedPreferences not opened with MODE_WORLD_READABLE or MODE_WORLD_WRITEABLE", "severity": "critical", "automated": true },
+    { "id": "mobile_android_content_provider_permission", "title": "Android: ContentProvider with exported=true has explicit readPermission and writePermission", "severity": "high", "automated": true },
+    { "id": "mobile_rn_async_storage_sensitive", "title": "React Native: AsyncStorage not used for credentials or tokens — use react-native-keychain or Expo SecureStore", "severity": "high", "automated": true },
+    { "id": "mobile_rn_codepush_integrity", "title": "React Native: OTA bundle updates verified with code signing before execution", "severity": "high", "automated": true },
+    { "id": "mobile_flutter_sharedprefs_sensitive", "title": "Flutter: Sensitive data stored in flutter_secure_storage, not shared_preferences", "severity": "high", "automated": true },
+    { "id": "mobile_expo_async_vs_secure", "title": "Expo: Credentials and tokens stored in SecureStore, not AsyncStorage", "severity": "high", "automated": true },
+    { "id": "mobile_certificate_transparency", "title": "Certificate Transparency enforcement enabled for production domains", "severity": "medium", "automated": true }
   ]
 }

package/defaults/checklists/payments.json

@@ -20,6 +20,20 @@
     { "id": "pci_chargeback_monitoring", "description": "Chargeback monitoring and alerting configured with defined response process", "critical": false },
     { "id": "pci_data_retention", "description": "Payment data retention policy enforced — data purged per PCI DSS schedule", "critical": true },
     { "id": "pci_ir_playbook", "description": "Payment fraud and PCI breach IR playbooks exist and are current", "critical": true },
-    { "id": "pci_threat_model", "description": "Threat model completed and reviewed for this payment surface change", "critical": true }
+    { "id": "pci_threat_model", "description": "Threat model completed and reviewed for this payment surface change", "critical": true },
+    { "id": "pci_magecart_prevention", "description": "Magecart/digital-skimming prevention: SRI hashes on all checkout page scripts; CSP blocks unauthorized exfiltration destinations; DOM mutation monitoring detects injected form skimmers", "critical": true },
+    { "id": "pci_3ds_enforced", "description": "EMV 3D Secure 2.2+ enforced for card-not-present transactions above risk threshold; step-up authentication triggered by anomaly score; 3DS bypass attempts logged and alerted", "critical": true },
+    { "id": "pci_currency_validation", "title": "Payment currency fixed server-side — client-supplied currency code rejected or validated against strict allowlist", "severity": "critical", "automated": true },
+    { "id": "pci_discount_stacking", "title": "Discount/coupon stacking limited server-side — maximum one promotion per order enforced atomically", "severity": "high", "automated": true },
+    { "id": "pci_payment_confirmation_server_side", "title": "Order/fulfillment status derived exclusively from payment processor API response — never from client-supplied status field", "severity": "critical", "automated": true },
+    { "id": "pci_webhook_timestamp_tolerance", "title": "Webhook timestamp tolerance ≤ 300 seconds — stale events rejected", "severity": "high", "automated": true },
+    { "id": "pci_server_side_totals", "title": "Tax, shipping, and discount amounts computed server-side — never sourced from client request body", "severity": "high", "automated": true },
+    { "id": "pci_total_revalidation", "title": "Final charge amount re-computed server-side from canonical item prices — client-supplied total field never used as charge amount", "severity": "critical", "automated": true },
+    { "id": "pci_referral_abuse_prevention", "title": "Referral/signup bonus protected against self-referral and multi-account abuse with deduplication", "severity": "high", "automated": true },
+    { "id": "biz_email_normalization", "title": "Email addresses normalised before uniqueness check — duplicate account creation via aliasing prevented", "severity": "high", "automated": true },
+    { "id": "biz_feature_flag_server_side", "title": "Feature entitlements derived from server-side session/database record — not from client-supplied plan/tier/featureFlag parameters", "severity": "high", "automated": true },
+    { "id": "biz_api_version_controls_parity", "title": "All security controls applied uniformly across all live API versions — deprecated versions sunset or mirrored", "severity": "high", "automated": false },
+    { "id": "pci_trial_abuse_prevention", "title": "Free trial creation checked for velocity on payment method fingerprint, BIN prefix, IP, and device identifier", "severity": "high", "automated": true },
+    { "id": "pci_payment_intent_idempotency", "title": "Payment intent charge guarded by distributed lock or unique constraint — concurrent double-charge prevented", "severity": "critical", "automated": true }
   ]
 }

package/defaults/checklists/web.json

@@ -25,6 +25,16 @@
     { "id": "web_sast_pass", "description": "SAST scan passed with no CRITICAL findings", "critical": true },
     { "id": "web_secrets_scan", "description": "Secrets scan clean — no credentials or tokens in source code", "critical": true },
     { "id": "web_logging", "description": "Required security events logged — no PII, tokens, or secrets in logs", "critical": false },
-    { "id": "web_staging_verified", "description": "Security headers verified in staging environment with automated check", "critical": false }
+    { "id": "web_staging_verified", "description": "Security headers verified in staging environment with automated check", "critical": false },
+    { "id": "web_dom_clobbering", "description": "DOM clobbering prevention reviewed — named form inputs, anchors, and embeds do not shadow window/document properties used in application logic", "critical": true },
+    { "id": "web_cache_poisoning", "description": "Web cache poisoning prevented — unkeyed headers (X-Forwarded-Host, X-Original-URL, X-Rewrite-URL) are not reflected in cached responses or redirects", "critical": true },
+    { "id": "web_websocket_auth", "description": "WebSocket upgrade validates authentication independently (token in first message or query param signed); does not rely solely on session cookies which bypass CORS", "critical": true },
+    { "id": "web_postmessage_origin", "description": "postMessage listeners validate event.origin against an explicit allowlist before processing any message data — no wildcard '*' as trusted origin", "critical": true },
+    { "id": "web_dangling_markup", "description": "Dangling markup injection reviewed — no user-controlled partial HTML tags output across multi-step page generation; prevents attribute-injection data exfiltration", "critical": false },
+    { "id": "web_css_injection", "title": "User input not written into CSS style attributes, CSS-in-JS template literals, or <style> blocks", "severity": "high", "automated": true },
+    { "id": "web_dangling_markup_check", "title": "Dangling markup injection prevention — no user-controlled partial HTML tags in server-rendered output", "severity": "high", "automated": true },
+    { "id": "web_postmessage_wildcard", "title": "postMessage sender does not use wildcard '*' as targetOrigin for sensitive data", "severity": "medium", "automated": true },
+    { "id": "web_cache_poisoning_headers", "title": "Unkeyed headers (X-Forwarded-Host, X-Original-URL) not reflected in cached responses or redirects", "severity": "medium", "automated": true },
+    { "id": "web_missing_sri", "title": "All external scripts and stylesheets loaded with Subresource Integrity (SRI) integrity= attribute", "severity": "medium", "automated": true }
   ]
 }

package/defaults/control-catalog.json

@@ -544,6 +544,206 @@
       "surfaces": ["all"],
       "frameworks": ["GDPR", "HIPAA", "PCI DSS 4.0"],
       "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "OAUTH_PKCE_ENFORCED",
+      "description": "All OAuth 2.0 public clients use PKCE with S256 code challenge method.",
+      "automation": "tooling",
+      "surfaces": ["web", "api", "mobile"],
+      "frameworks": ["RFC 7636", "OWASP ASVS 3.5.3"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "JWT_ALG_CONFUSION_PREVENTED",
+      "description": "All jwt.verify() calls pin the algorithm to RS256/ES256 — algorithm confusion attack prevented.",
+      "automation": "tooling",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-327", "OWASP A07"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "SESSION_FIXATION_PREVENTED",
+      "description": "Session is regenerated after authentication to prevent session fixation attacks.",
+      "automation": "tooling",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-384", "OWASP A07"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "BUSINESS_LOGIC_REVIEWED",
+      "description": "Business logic abuse scenarios (state skipping, negative values, race conditions) are tested before release.",
+      "automation": "evidence",
+      "surfaces": ["all"],
+      "frameworks": ["OWASP Testing Guide OTG-BUSLOGIC", "NIST SP 800-53 SA-11"],
+      "evidence": ["pentest-report.json", "threat-model.json"]
+    },
+    {
+      "id": "RACE_CONDITION_MITIGATED",
+      "description": "All limit-once invariants (balance, quota, inventory, coupons) are protected by atomic DB operations.",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["CWE-362", "OWASP Testing Guide OTG-BUSLOGIC-009"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "PROTOTYPE_POLLUTION_MITIGATED",
+      "description": "All object merges of user-controlled data are protected by schema validation before merge.",
+      "automation": "tooling",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-1321", "OWASP A03"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "HTTP_SMUGGLING_MITIGATED",
+      "description": "Proxy and origin servers normalize CL/TE headers; H2C upgrade disabled.",
+      "automation": "evidence",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-444", "OWASP Testing Guide OTG-INPVAL-016"],
+      "evidence": ["pentest-report.json"]
+    },
+    {
+      "id": "XXE_PREVENTED",
+      "description": "XML parsers disable external entity processing (processEntities:false).",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["CWE-611", "OWASP A03"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "SSTI_PREVENTED",
+      "description": "Server-side templates are never compiled from user-controlled input.",
+      "automation": "tooling",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-94", "OWASP A03"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "DESERIALIZATION_SAFE",
+      "description": "Untrusted data is never passed to unsafe deserialization functions (node-serialize, eval, new Function).",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["CWE-502", "OWASP A08"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "NOSQL_INJECTION_PREVENTED",
+      "description": "MongoDB/DynamoDB queries are built from validated fields, not raw user input.",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["CWE-943", "OWASP A03"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "HTTP_VERB_TAMPERING_PREVENTED",
+      "description": "Read-only endpoints return 405 on PUT/DELETE — HTTP verb tampering blocked.",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["OWASP Testing Guide OTG-INPVAL-003"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "OPEN_REDIRECT_BLOCKED",
+      "description": "All res.redirect() targets are validated against an allowlist or enforced relative-only.",
+      "automation": "tooling",
+      "surfaces": ["web", "api"],
+      "frameworks": ["CWE-601", "OWASP A01"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "SUBDOMAIN_TAKEOVER_MITIGATED",
+      "description": "DNS audit confirms no dangling CNAME records pointing to unprovisioned services.",
+      "automation": "evidence",
+      "surfaces": ["web"],
+      "frameworks": ["OWASP Testing Guide OTG-CONFIG-010"],
+      "evidence": ["dns-audit.json"]
+    },
+    {
+      "id": "GRAPHQL_FULL_HARDENING",
+      "description": "GraphQL introspection disabled, depth/complexity limits enforced, batching limited, field-level auth present.",
+      "automation": "tooling",
+      "surfaces": ["api"],
+      "frameworks": ["OWASP API Security Top 10", "OWASP Testing Guide"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "AI_MULTIMODAL_INJECTION_PREVENTED",
+      "description": "Multimodal inputs (image, audio, document) are treated as untrusted and cannot inject instructions.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["OWASP LLM01", "MITRE ATLAS AML.T0054"],
+      "evidence": ["ai-redteam-report.json"]
+    },
+    {
+      "id": "AI_MEMORY_POISONING_PREVENTED",
+      "description": "Agent memory and scratchpad content is validated before use in downstream instructions.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["OWASP LLM08", "MITRE ATLAS"],
+      "evidence": ["ai-redteam-report.json"]
+    },
+    {
+      "id": "AI_MODEL_INVERSION_MITIGATED",
+      "description": "Model cannot be probed to recite training PII or memorized secrets.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["OWASP LLM06", "MITRE ATLAS AML.T0057"],
+      "evidence": ["ai-redteam-report.json"]
+    },
+    {
+      "id": "MASVS_ANTI_REVERSING",
+      "description": "Mobile release binary uses code obfuscation and anti-instrumentation controls (MASVS-RESILIENCE).",
+      "automation": "evidence",
+      "surfaces": ["mobile"],
+      "frameworks": ["OWASP MASVS 2.0 RESILIENCE"],
+      "evidence": ["mobile-binary-review.json"]
+    },
+    {
+      "id": "IMDS_V2_ENFORCED",
+      "description": "EC2 instances enforce IMDSv2 (HttpTokens=required) — IMDSv1 disabled.",
+      "automation": "tooling",
+      "surfaces": ["infra"],
+      "frameworks": ["CIS AWS Foundations Benchmark 5.6", "NIST SP 800-53 SC-7"],
+      "required_scanners": ["checkov"]
+    },
+    {
+      "id": "CLOUD_THREAT_DETECTION_ENABLED",
+      "description": "AWS GuardDuty / GCP SCC / Azure Defender for Cloud is enabled across all accounts.",
+      "automation": "tooling",
+      "surfaces": ["infra"],
+      "frameworks": ["CIS Benchmark", "NIST SP 800-53 SI-3"],
+      "required_scanners": ["checkov"]
+    },
+    {
+      "id": "MAGECART_PROTECTION",
+      "description": "Payment pages enforce extra-strict CSP and SRI on all scripts — Magecart e-skimming prevented.",
+      "automation": "tooling",
+      "surfaces": ["payments", "web"],
+      "frameworks": ["PCI DSS 4.0 Req 6.4.3", "OWASP ASVS 14.4"],
+      "required_scanners": ["semgrep"]
+    },
+    {
+      "id": "PCI_3DS_V2_ENFORCED",
+      "description": "EMV 3DS version 2.2+ is used for all card-not-present high-risk transactions.",
+      "automation": "evidence",
+      "surfaces": ["payments"],
+      "frameworks": ["PCI DSS 4.0 Req 8", "EMV 3DS 2.2"],
+      "evidence": ["payment-integration-test-results.json"]
+    },
+    {
+      "id": "HIPAA_PHI_CONTROLS",
+      "description": "Protected Health Information (PHI) is encrypted at rest and in transit; access is limited and audited.",
+      "automation": "evidence",
+      "surfaces": ["all"],
+      "frameworks": ["HIPAA §164.312", "NIST SP 800-53 SC-28"],
+      "evidence": ["hipaa-phi-audit.json"]
+    },
+    {
+      "id": "SUPPLY_CHAIN_CICD_HARDENED",
+      "description": "All CI/CD GitHub Actions are SHA-pinned; GITHUB_TOKEN has minimal permissions; no pwn-request risk.",
+      "automation": "tooling",
+      "surfaces": ["infra"],
+      "frameworks": ["SLSA Level 3", "NIST SP 800-161", "CIS Software Supply Chain Benchmark"],
+      "required_scanners": ["semgrep", "checkov"]
     }
   ]
 }

package/defaults/security-policy.json

@@ -4,8 +4,8 @@
   "description": "Default security gate policy for security-mcp. Copy to .mcp/policies/security-policy.json and customize for your project.",
   "required_checks": {
     "secrets_scan": { "severity_block": ["HIGH", "CRITICAL"] },
-    "dependency_scan": { "severity_block": ["CRITICAL"] },
-    "sast": { "severity_block": ["CRITICAL"] },
+    "dependency_scan": { "severity_block": ["HIGH", "CRITICAL"] },
+    "sast": { "severity_block": ["HIGH", "CRITICAL"] },
     "iac_scan": { "severity_block": ["HIGH", "CRITICAL"] }
   },
   "environments": {

package/dist/cli/index.js

@@ -9,9 +9,11 @@
  *   --version
  *   --help
  */
-import { createRequire } from "module";
-import { fileURLToPath } from "url";
-import { dirname, resolve } from "path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { homedir, platform } from "node:os";
 import { runInstall } from "./install.js";
 import { main as runServer } from "../mcp/server.js";
 import { notifyIfUpdateAvailable } from "./update.js";
@@ -55,6 +57,7 @@ COMMANDS
   install          Auto-detect installed editors and write MCP configs
   install-global   Install using the globally installed security-mcp binary
   config           Print MCP config JSON for manual editor setup
+  doctor           Verify the installation is working correctly
 
 OPTIONS (install)
   --claude-code        Write config for Claude Code only
@@ -87,6 +90,9 @@ EXAMPLES
   # Preview install without writing:
   npx -y security-mcp@latest install --dry-run
 
+  # Verify installation health:
+  npx -y security-mcp@latest doctor
+
   # Print JSON config snippet:
   npx -y security-mcp@latest config
   security-mcp config --use-global-binary
@@ -103,11 +109,76 @@ EDITOR CONFIG (add manually if install fails):
 
   Claude Code:  ~/.claude/settings.json
   Cursor:       ~/.cursor/mcp.json  or  .cursor/mcp.json
-  VS Code:      .vscode/mcp.json   (workspace)
+  VS Code:      User settings.json  (via Preferences > Open User Settings JSON)
+  Windsurf:     ~/.windsurf/mcp.json
 
 MORE INFO
   https://github.com/AbrahamOO/security-mcp
 `;
+function resolveHome(p) {
+    return p.replace(/^~/, homedir());
+}
+function getVsCodeSettingsPath() {
+    const os = platform();
+    if (os === "win32")
+        return `${process.env["APPDATA"] ?? ""}\\Code\\User\\settings.json`;
+    if (os === "darwin")
+        return `${homedir()}/Library/Application Support/Code/User/settings.json`;
+    return `${homedir()}/.config/Code/User/settings.json`;
+}
+function runDoctor() {
+    const checks = [];
+    // Node.js version
+    const nodeVer = process.versions.node.split(".").map(Number);
+    const nodeOk = (nodeVer[0] ?? 0) >= 20;
+    checks.push({ label: `Node.js ${process.versions.node}`, ok: nodeOk, hint: nodeOk ? undefined : "Node.js 20+ required. Download from https://nodejs.org" });
+    // Claude Code config
+    const claudeConfig = resolveHome("~/.claude/settings.json");
+    const claudeOk = existsSync(claudeConfig);
+    checks.push({ label: `Claude Code config (${claudeConfig})`, ok: claudeOk, hint: claudeOk ? undefined : "Run: npx -y security-mcp@latest install --claude-code" });
+    // Claude Code skill
+    const skillPath = resolveHome("~/.claude/skills/senior-security-engineer/SKILL.md");
+    const skillOk = existsSync(skillPath);
+    checks.push({ label: `senior-security-engineer skill (${skillPath})`, ok: skillOk, hint: skillOk ? undefined : "Run: npx -y security-mcp@latest install --claude-code" });
+    // Cursor global config
+    const cursorConfig = resolveHome("~/.cursor/mcp.json");
+    if (existsSync(resolveHome("~/.cursor"))) {
+        const cursorOk = existsSync(cursorConfig);
+        checks.push({ label: `Cursor config (${cursorConfig})`, ok: cursorOk, hint: cursorOk ? undefined : "Run: npx -y security-mcp@latest install --cursor" });
+    }
+    // VS Code config
+    const vscodePath = getVsCodeSettingsPath();
+    if (existsSync(vscodePath)) {
+        checks.push({ label: `VS Code config (${vscodePath})`, ok: true });
+    }
+    // Windsurf config
+    const windsurfConfig = resolveHome("~/.windsurf/mcp.json");
+    if (existsSync(resolveHome("~/.windsurf"))) {
+        const windsurfOk = existsSync(windsurfConfig);
+        checks.push({ label: `Windsurf config (${windsurfConfig})`, ok: windsurfOk, hint: windsurfOk ? undefined : "Run: npx -y security-mcp@latest install" });
+    }
+    process.stdout.write(`\nsecurity-mcp doctor v${VERSION}\n`);
+    process.stdout.write("=".repeat(40) + "\n\n");
+    let allOk = true;
+    for (const check of checks) {
+        const status = check.ok ? "PASS" : "FAIL";
+        process.stdout.write(`  [${status}] ${check.label}\n`);
+        if (!check.ok) {
+            allOk = false;
+            if (check.hint)
+                process.stdout.write(`         Fix: ${check.hint}\n`);
+        }
+    }
+    process.stdout.write("\n");
+    if (allOk) {
+        process.stdout.write("All checks passed. security-mcp is installed correctly.\n");
+        process.stdout.write("Restart your editor if you haven't already, then type /senior-security-engineer.\n\n");
+    }
+    else {
+        process.stdout.write("Some checks failed. Run the suggested fix commands above, then re-run: npx -y security-mcp@latest doctor\n\n");
+        process.exit(1);
+    }
+}
 async function main() {
     const args = process.argv.slice(2);
     const useGlobalBinary = args.includes("--use-global-binary");
@@ -165,7 +236,13 @@ async function main() {
             process.stdout.write("\nAdd the above to your editor's MCP config file.\n");
             process.stdout.write("  Claude Code:  ~/.claude/settings.json\n");
             process.stdout.write("  Cursor:       ~/.cursor/mcp.json\n");
-            process.stdout.write("  VS Code:      .vscode/mcp.json\n");
+            process.stdout.write("  VS Code:      User settings.json (Preferences > Open User Settings JSON)\n");
+            process.stdout.write("  Windsurf:     ~/.windsurf/mcp.json\n");
+            break;
+        }
+        case "doctor":
+        case "verify": {
+            runDoctor();
             break;
         }
         default: {

package/dist/cli/install.js

@@ -29,6 +29,7 @@ function getEditorTargets(opts) {
     const cursorGlobalPath = resolveHome("~/.cursor/mcp.json");
     const cursorLocalPath = ".cursor/mcp.json";
     const vscodePath = getVsCodeSettingsPath();
+    const windsurfPath = resolveHome("~/.windsurf/mcp.json");
     const all = [
         {
             name: "Claude Code",
@@ -53,6 +54,12 @@ function getEditorTargets(opts) {
             configPath: vscodePath,
             type: "vscode-settings",
             detected: existsSync(vscodePath)
+        },
+        {
+            name: "Windsurf",
+            configPath: windsurfPath,
+            type: "mcp-servers-json",
+            detected: existsSync(resolveHome("~/.windsurf"))
         }
     ];
     if (opts.all) {
@@ -166,11 +173,24 @@ function installSkill(dryRun) {
  */
 // CWE-22: only alphanumeric, hyphens, and dots allowed in skill names
 const SAFE_SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+// CWE-918: allowlist for skill download hosts — no user-controlled URLs reach the network
+const ALLOWED_SKILL_HOSTS = new Set(["raw.githubusercontent.com", "github.com"]);
 export async function downloadSkill(skillName, url, dryRun = false) {
     if (!SAFE_SKILL_NAME_RE.test(skillName)) {
         process.stdout.write(`  [error] invalid skill name "${skillName}" — skipping download\n`);
         return;
     }
+    try {
+        const { hostname } = new URL(url);
+        if (!ALLOWED_SKILL_HOSTS.has(hostname)) {
+            process.stdout.write(`  [error] blocked skill download from unauthorized host "${hostname}"\n`);
+            return;
+        }
+    }
+    catch {
+        process.stdout.write(`  [error] invalid skill URL "${url}" — skipping download\n`);
+        return;
+    }
     const skillDest = resolveHome(`~/.claude/skills/${skillName}/SKILL.md`);
     if (dryRun) {
         process.stdout.write(`  [dry-run] would download skill "${skillName}" from ${url} → ${skillDest}\n`);
@@ -271,12 +291,22 @@ export async function runInstall(opts) {
     process.stdout.write("\nInstalling security policy...\n");
     installPolicy(dryRun);
     process.stdout.write("\n");
-    process.stdout.write(dryRun
-        ? "Dry-run complete. Re-run without --dry-run to apply.\n"
-        : "Done! Restart your editor to activate the security-mcp server.\n");
+    if (dryRun) {
+        process.stdout.write("Dry-run complete. Re-run without --dry-run to apply.\n\n");
+        return;
+    }
+    process.stdout.write("Installation complete!\n");
     process.stdout.write(`Install mode: ${opts.useGlobalBinary ? "global binary (security-mcp serve)" : "npx (npx -y security-mcp@latest serve)"}\n`);
     process.stdout.write("\nNext steps:\n");
-    process.stdout.write("  1. Restart your editor.\n");
-    process.stdout.write('  2. In Claude Code, type /senior-security-engineer to activate the security persona.\n');
-    process.stdout.write('  3. Ask your AI: "Run security.start_review with mode=recent_changes" to begin an auditable review.\n\n');
+    process.stdout.write("  1. Restart your editor (fully quit and reopen — not just reload window).\n");
+    process.stdout.write("  2. Verify the server loaded:\n");
+    process.stdout.write("       Claude Code: type /mcp and confirm security-mcp is listed as Connected.\n");
+    process.stdout.write("       Cursor:       Settings > MCP > security-mcp should show as active.\n");
+    process.stdout.write("  3. Run your first security review:\n");
+    process.stdout.write("       /senior-security-engineer\n");
+    process.stdout.write("     The agent will ask you to choose a scan scope (recent changes / full codebase / specific files).\n");
+    process.stdout.write("  4. For a deep 39-agent audit before a release:\n");
+    process.stdout.write("       /ciso-orchestrator\n");
+    process.stdout.write("\nVerify this install at any time:\n");
+    process.stdout.write("  npx -y security-mcp@latest --version\n\n");
 }

package/dist/cli/onboarding.js

@@ -275,8 +275,14 @@ async function fetchLatestRelease(repo) {
 function pickAsset(assets, pattern) {
     return assets.find((a) => a.name.toLowerCase().includes(pattern.toLowerCase()))?.browser_download_url;
 }
+const ALLOWED_BINARY_HOSTS = new Set([
+    "github.com", "objects.githubusercontent.com", "github-releases.githubusercontent.com"
+]);
 async function downloadBinary(url, dest) {
     try {
+        const { hostname } = new URL(url);
+        if (!ALLOWED_BINARY_HOSTS.has(hostname))
+            return false;
         const res = await fetch(url);
         if (!res.ok || !res.body)
             return false;