security-mcp 1.1.4 → 1.3.3

package/dist/mcp/audit-chain.js

@@ -15,8 +15,9 @@
  * The genesis block (link 0) contains only the agentRunId and a timestamp —
  * its parent hash is all-zeros.
  */
-import { createHash } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
 // ---------------------------------------------------------------------------
@@ -33,30 +34,84 @@ function validateAgentRunId(agentRunId) {
     }
 }
 // ---------------------------------------------------------------------------
+// HMAC key reader
+// ---------------------------------------------------------------------------
+const AUDIT_HMAC_MIN_KEY_BYTES = 32;
+function getAuditHmacKey() {
+    const key = process.env.SECURITY_AUDIT_HMAC_KEY ?? process.env.SECURITY_POLICY_HMAC_KEY;
+    if (!key)
+        return null;
+    const buf = Buffer.from(key, "hex");
+    // Guard against invalid hex strings (Buffer.from silently drops non-hex chars,
+    // potentially producing a 0-length key) and keys that are too short.
+    if (buf.length < AUDIT_HMAC_MIN_KEY_BYTES) {
+        throw new Error(`SECURITY_AUDIT_HMAC_KEY decoded to ${buf.length} bytes — minimum ${AUDIT_HMAC_MIN_KEY_BYTES} bytes required. ` +
+            `Ensure the value is a valid hex-encoded string of at least ${AUDIT_HMAC_MIN_KEY_BYTES * 2} hex characters.`);
+    }
+    return buf;
+}
+// ---------------------------------------------------------------------------
 // Hash helpers
 // ---------------------------------------------------------------------------
 function sha256(data) {
     return createHash("sha256").update(data, "utf-8").digest("hex");
 }
+function hmacSha256(key, data) {
+    return createHmac("sha256", key).update(data, "utf-8").digest("hex");
+}
 function hashFindings(findings) {
     return sha256(JSON.stringify(findings));
 }
-function computeChainHash(record) {
-    const payload = [
+/**
+ * Public helper: compute the canonical SHA-256 of a findings array exactly as
+ * `attestAgent` does. Used by orchestration.mergeAgentFindings to verify that an
+ * agent's findings file matches the hash that agent attested to — i.e. that the
+ * inter-agent payload was not tampered with between attestation and merge.
+ */
+export function computeFindingsHash(findings) {
+    return hashFindings(findings);
+}
+function buildChainPayload(record) {
+    return [
         record.agentRunId,
         record.agentName,
         record.completedAt,
         record.findingsHash,
         record.parentHash
     ].join("|");
-    return sha256(payload);
+}
+function computeChainHash(record) {
+    const payload = buildChainPayload(record);
+    const key = getAuditHmacKey();
+    if (key) {
+        const mac = hmacSha256(key, payload);
+        return { chainHash: mac, hmacSha256: mac };
+    }
+    return { chainHash: sha256(payload) };
+}
+// ---------------------------------------------------------------------------
+// Atomic write helper
+// ---------------------------------------------------------------------------
+async function atomicWrite(targetPath, data) {
+    const tmpPath = join(tmpdir(), `audit-chain-${Date.now()}-${randomBytes(8).toString("hex")}.tmp`);
+    try {
+        await writeFile(tmpPath, data, { encoding: "utf-8", mode: 0o600 });
+        await rename(tmpPath, targetPath); // atomic on same filesystem
+    }
+    catch (e) {
+        try {
+            await unlink(tmpPath);
+        }
+        catch { /* ignore cleanup errors */ }
+        throw e;
+    }
 }
 // ---------------------------------------------------------------------------
 // Storage helpers
 // ---------------------------------------------------------------------------
 async function ensureRunDir(agentRunId) {
     const dir = join(AGENT_RUNS_DIR, agentRunId);
-    await mkdir(dir, { recursive: true });
+    await mkdir(dir, { mode: 0o700, recursive: true });
 }
 function chainPath(agentRunId) {
     return join(AGENT_RUNS_DIR, agentRunId, "attestation-chain.json");
@@ -75,7 +130,7 @@ async function loadChain(agentRunId) {
 async function saveChain(chain) {
     await ensureRunDir(chain.agentRunId);
     chain.updatedAt = new Date().toISOString();
-    await writeFile(chainPath(chain.agentRunId), JSON.stringify(chain, null, 2) + "\n", "utf-8");
+    await atomicWrite(chainPath(chain.agentRunId), JSON.stringify(chain, null, 2) + "\n");
 }
 // ---------------------------------------------------------------------------
 // Core functions
@@ -90,7 +145,7 @@ export async function initChain(agentRunId) {
     if (chain.links.length > 0)
         return chain; // already initialised
     const completedAt = new Date().toISOString();
-    const genesis = {
+    const genesisPartial = {
         link: 0,
         agentRunId,
         agentName: "genesis",
@@ -101,9 +156,11 @@ export async function initChain(agentRunId) {
         criticalCount: 0,
         highCount: 0
     };
+    const { chainHash, hmacSha256: mac } = computeChainHash(genesisPartial);
     const record = {
-        ...genesis,
-        chainHash: computeChainHash(genesis)
+        ...genesisPartial,
+        chainHash,
+        ...(mac !== undefined ? { hmacSha256: mac } : {})
     };
     chain.links.push(record);
     await saveChain(chain);
@@ -134,9 +191,11 @@ export async function attestAgent(params) {
         criticalCount: params.findings.filter((f) => f.severity === "CRITICAL").length,
         highCount: params.findings.filter((f) => f.severity === "HIGH").length
     };
+    const { chainHash, hmacSha256: mac } = computeChainHash(partial);
     const record = {
         ...partial,
-        chainHash: computeChainHash(partial)
+        chainHash,
+        ...(mac !== undefined ? { hmacSha256: mac } : {})
     };
     chain.links.push(record);
     await saveChain(chain);
@@ -146,6 +205,11 @@ export async function attestAgent(params) {
  * Verify the integrity of the entire attestation chain for an agent run.
  * Recomputes every chain hash from scratch and checks parent linkage.
  * Returns `valid: true` only if every link is intact.
+ *
+ * HMAC behaviour:
+ *  - Key present + links signed: verifies HMAC on every link.
+ *  - Key absent + links signed: returns valid=false (cannot verify).
+ *  - Key absent + links unsigned: returns valid=true with a warning.
  */
 export async function verifyChain(agentRunId) {
     const chain = await loadChain(agentRunId);
@@ -163,6 +227,22 @@ export async function verifyChain(agentRunId) {
             }
         };
     }
+    const hmacKey = getAuditHmacKey();
+    const chainIsSigned = chain.links.some((l) => l.hmacSha256 !== undefined);
+    // Key absent but chain is signed — cannot verify
+    if (!hmacKey && chainIsSigned) {
+        return {
+            agentRunId,
+            valid: false,
+            linkCount: chain.links.length,
+            verifiedAt,
+            broken: {
+                linkIndex: 0,
+                agentName: chain.links[0].agentName,
+                reason: "Chain is signed but SECURITY_AUDIT_HMAC_KEY is not set — cannot verify integrity."
+            }
+        };
+    }
     // Verify genesis parent hash
     if (chain.links[0].parentHash !== GENESIS_PARENT_HASH) {
         return {
@@ -179,10 +259,16 @@ export async function verifyChain(agentRunId) {
     }
     for (let i = 0; i < chain.links.length; i++) {
         const link = chain.links[i];
-        // Recompute chain hash
-        const { chainHash: _stored, ...rest } = link;
-        const recomputed = computeChainHash(rest);
-        if (recomputed !== link.chainHash) {
+        // Recompute chain hash (HMAC if key present, SHA-256 otherwise)
+        const { chainHash: _stored, hmacSha256: _mac, ...rest } = link;
+        const payload = buildChainPayload(rest);
+        const recomputed = hmacKey ? hmacSha256(hmacKey, payload) : sha256(payload);
+        // CWE-208: use constant-time comparison to prevent timing oracle on HMAC values
+        const recomputedBuf = Buffer.from(recomputed, "hex");
+        const storedBuf = Buffer.from(link.chainHash, "hex");
+        const hashMismatch = recomputedBuf.length !== storedBuf.length ||
+            !timingSafeEqual(recomputedBuf, storedBuf);
+        if (hashMismatch) {
             return {
                 agentRunId,
                 valid: false,
@@ -195,21 +281,38 @@ export async function verifyChain(agentRunId) {
                 }
             };
         }
-        // Verify parent linkage
-        if (i > 0 && link.parentHash !== chain.links[i - 1].chainHash) {
-            return {
-                agentRunId,
-                valid: false,
-                linkCount: chain.links.length,
-                verifiedAt,
-                broken: {
-                    linkIndex: i,
-                    agentName: link.agentName,
-                    reason: `Parent hash at link ${i} does not match chain hash of link ${i - 1} — chain is broken.`
-                }
-            };
+        // Verify parent linkage (CWE-208: constant-time comparison)
+        if (i > 0) {
+            const parentBuf = Buffer.from(link.parentHash, "hex");
+            const prevChainBuf = Buffer.from(chain.links[i - 1].chainHash, "hex");
+            const parentMismatch = parentBuf.length !== prevChainBuf.length ||
+                !timingSafeEqual(parentBuf, prevChainBuf);
+            if (parentMismatch) {
+                return {
+                    agentRunId,
+                    valid: false,
+                    linkCount: chain.links.length,
+                    verifiedAt,
+                    broken: {
+                        linkIndex: i,
+                        agentName: link.agentName,
+                        reason: `Parent hash at link ${i} does not match chain hash of link ${i - 1} — chain is broken.`
+                    }
+                };
+            }
         }
     }
+    // Key absent and chain unsigned — warn but pass
+    if (!hmacKey && !chainIsSigned) {
+        return {
+            agentRunId,
+            valid: true,
+            linkCount: chain.links.length,
+            verifiedAt,
+            warning: "Chain integrity is hash-only, not cryptographically signed. Set SECURITY_AUDIT_HMAC_KEY for tamper protection.",
+            broken: null
+        };
+    }
     return {
         agentRunId,
         valid: true,

package/dist/mcp/auth.js

@@ -0,0 +1,169 @@
+/**
+ * MCP caller authentication for security-mcp.
+ *
+ * When SECURITY_MCP_SHARED_SECRET is set, every tool call is blocked until
+ * security.authenticate is called with the matching token. This provides a
+ * process-boundary guard against rogue processes that somehow obtain access
+ * to the MCP stdio channel without being the intended AI coding agent.
+ *
+ * Design notes:
+ * - One stdio session = one server process = one auth state (module singleton).
+ * - Token comparison uses constant-time HMAC to eliminate length-based timing
+ *   oracles (CWE-208). Both inputs are hashed to 32-byte digests before compare.
+ * - After AUTH_MAX_ATTEMPTS failures the process exits to prevent brute-force.
+ * - If SECURITY_MCP_SHARED_SECRET is absent, auth is disabled and all tools are
+ *   immediately available (backwards-compatible default).
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+/** Domain-separation constant for auth HMAC. Never changes. */
+const HMAC_DOMAIN = "security-mcp-session-auth-v1";
+/**
+ * Minimum acceptable secret length (bytes).
+ * OWASP ASVS L2 V2.9.1 requires 32 bytes (256 bits) for HMAC secrets.
+ * NIST SP 800-107 §5.3.4 / SP 800-131A recommend ≥ 112-bit keys for HMAC-SHA256;
+ * we enforce 32 bytes (256-bit) for full ASVS L2 compliance.
+ */
+const SECRET_MIN_BYTES = 32;
+/** Maximum failed authentication attempts before the server process exits. */
+const AUTH_MAX_ATTEMPTS = 3;
+/** Unique ID for this server instance (for logging / correlation only). */
+const SESSION_ID = randomBytes(16).toString("hex");
+let _authenticated = false;
+let _authenticatedAt = null;
+let _attempts = 0;
+/** Whether the caller must authenticate before using any other tool. */
+export function isAuthRequired() {
+    return typeof process.env["SECURITY_MCP_SHARED_SECRET"] === "string" &&
+        process.env["SECURITY_MCP_SHARED_SECRET"].length > 0;
+}
+/**
+ * Whether the current session is authenticated.
+ * Always returns true when auth is disabled (no SECURITY_MCP_SHARED_SECRET).
+ * Enforces session TTL: if the session has exceeded SECURITY_SESSION_TTL_MS
+ * (default 8 hours), it is automatically invalidated and false is returned.
+ */
+export function isAuthenticated() {
+    if (!isAuthRequired())
+        return true;
+    if (_authenticated && _authenticatedAt) {
+        // Guard against NaN/negative from malformed env var — attacker-set "" or "abc"
+        // would produce NaN, making the comparison always false and bypassing TTL (CWE-1288).
+        // Also cap the TTL at 24 hours (86400000 ms) to prevent an attacker who controls
+        // the env from setting an arbitrarily large value that effectively disables TTL expiry.
+        // OWASP ASVS V3.7.1: sessions must expire within a reasonable bound.
+        const SESSION_TTL_MAX_MS = 86_400_000; // 24 hours absolute maximum
+        const parsedTtl = Number.parseInt(process.env["SECURITY_SESSION_TTL_MS"] ?? "28800000", 10);
+        const SESSION_TTL_MS = Number.isFinite(parsedTtl) && parsedTtl > 0
+            ? Math.min(parsedTtl, SESSION_TTL_MAX_MS)
+            : 28800000;
+        if (Date.now() - _authenticatedAt > SESSION_TTL_MS) {
+            _authenticated = false;
+            _authenticatedAt = null;
+            return false;
+        }
+    }
+    return _authenticated;
+}
+/**
+ * Explicitly log out the current session. Resets authentication state,
+ * timestamp, and attempt counter so the next tool call may re-authenticate
+ * without being immediately locked out by a prior failed-attempt count.
+ *
+ * Resetting _attempts on logout is safe: the lockout is per-session (process
+ * lifetime). An attacker who already authenticated and then logged out has
+ * already passed the auth gate; preventing a legitimate re-auth after logout
+ * constitutes a self-inflicted denial of service (CWE-613-adjacent).
+ */
+export function logout() {
+    _authenticated = false;
+    _authenticatedAt = null;
+    _attempts = 0;
+}
+/**
+ * Increment the failed-attempt counter regardless of whether the input is
+ * structurally valid. Call this BEFORE Zod parsing in the authenticate handler
+ * so that malformed requests still burn a lockout attempt (fixes CWE-307 bypass
+ * via invalid-shape inputs that would otherwise never reach attemptAuth).
+ */
+export function recordAttempt() {
+    if (isAuthRequired() && !_authenticated) {
+        _attempts++;
+    }
+}
+export function getSessionId() {
+    return SESSION_ID;
+}
+/**
+ * Attempt to authenticate the session with the provided token.
+ *
+ * Uses constant-time HMAC comparison to prevent timing oracles regardless of
+ * token length. After AUTH_MAX_ATTEMPTS failures, terminates the process.
+ */
+export function attemptAuth(token) {
+    if (!isAuthRequired()) {
+        return { success: true, sessionId: SESSION_ID };
+    }
+    if (_authenticated) {
+        return { success: true, sessionId: SESSION_ID };
+    }
+    // NOTE: _attempts is incremented by recordAttempt() called BEFORE Zod parsing
+    // in the server.ts handler. Do not increment here again to avoid double-counting.
+    const remaining = AUTH_MAX_ATTEMPTS - _attempts;
+    // Enforce lockout BEFORE any other check — including misconfiguration — so that
+    // the short-secret path cannot bypass the three-strike limit (AUTH-001 / CWE-307).
+    // Fix: use <= 0 (not < 0). With < 0, remaining==0 (i.e. _attempts==AUTH_MAX_ATTEMPTS)
+    // would still reach the HMAC comparison — granting one extra attempt beyond policy.
+    if (remaining <= 0) {
+        setTimeout(() => process.exit(1), 200);
+        return {
+            success: false,
+            reason: "Authentication failed."
+        };
+    }
+    const secret = process.env["SECURITY_MCP_SHARED_SECRET"];
+    if (Buffer.byteLength(secret, "utf-8") < SECRET_MIN_BYTES) {
+        // Server misconfiguration — warn but do not leak the secret value or byte length.
+        return {
+            success: false,
+            reason: "Authentication failed."
+        };
+    }
+    // Hash both inputs to fixed-length 32-byte digests so timingSafeEqual always
+    // receives same-length buffers (prevents length-based timing oracle, CWE-208).
+    // Keys and messages are swapped relative to the original: the secret/token is
+    // used as the HMAC key and HMAC_DOMAIN is the fixed message (AUTH-003 / CWE-327).
+    const expected = createHmac("sha256", secret).update(HMAC_DOMAIN, "utf-8").digest();
+    const provided = createHmac("sha256", token).update(HMAC_DOMAIN, "utf-8").digest();
+    if (!timingSafeEqual(expected, provided)) {
+        return {
+            success: false,
+            // Do not expose attempt count to avoid targeted last-attempt attacks (AUTH-004 / CWE-204).
+            reason: "Authentication failed."
+        };
+    }
+    _authenticated = true;
+    _authenticatedAt = Date.now();
+    return { success: true, sessionId: SESSION_ID };
+}
+/**
+ * Returns the preamble to prepend to the system prompt when authentication
+ * is required but has not yet been completed.
+ */
+export function authSystemPromptPreamble() {
+    if (!isAuthRequired())
+        return "";
+    return [
+        "## ⚠️ Authentication Required",
+        "",
+        "This security-mcp server requires authentication before any security tools can be used.",
+        "**Call `security.authenticate` first** with the value of the `SECURITY_MCP_SHARED_SECRET`",
+        "environment variable configured on this server.",
+        "",
+        "```",
+        "security.authenticate({ token: \"<value of SECURITY_MCP_SHARED_SECRET>\" })",
+        "```",
+        "",
+        "All other tool calls will be rejected with UNAUTHENTICATED until this step completes.",
+        ""
+    ].join("\n");
+}

package/dist/mcp/learning.js

@@ -5,7 +5,8 @@
  * Routes future findings to the highest-performing agent automatically.
  * Persists to .mcp/memory/patterns.json (per-project, gitignore-safe).
  */
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash, timingSafeEqual } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { z } from "zod";
 // ---------------------------------------------------------------------------
@@ -13,10 +14,62 @@ import { z } from "zod";
 // ---------------------------------------------------------------------------
 const MEMORY_DIR = join(".mcp", "memory");
 const PATTERNS_FILE = join(MEMORY_DIR, "patterns.json");
-const MIN_SAMPLE_SIZE = 3; // need ≥3 outcomes before routing is trusted
+const PATTERNS_HASH_FILE = join(MEMORY_DIR, "patterns.sha256");
+const MIN_SAMPLE_SIZE = 10; // need ≥10 outcomes before routing is trusted (was 3 — too easy to manipulate)
 const HIGH_CONFIDENCE = 0.85; // route automatically above this success rate
 const LOW_CONFIDENCE = 0.40; // escalate below this success rate
 // ---------------------------------------------------------------------------
+// Suppression safety caps (OWASP LLM04 / LLM08 — Excessive Agency)
+// ---------------------------------------------------------------------------
+/**
+ * Maximum number of distinct finding IDs that may be simultaneously suppressed
+ * via false-positive rate. Prevents an attacker from suppressing ALL finding
+ * types by flooding the learning engine with false-positive reports across many IDs.
+ * MITRE ATLAS AML.T0043 (Craft Adversarial Data) mitigation.
+ */
+const MAX_SUPPRESSED_FINDING_TYPES = 5;
+/**
+ * Maximum cumulative false-positive count any single finding ID may accumulate
+ * before further FP submissions are rejected regardless of rate-limit window.
+ * Prevents an attacker who controls multiple agents from slowly poisoning a
+ * finding type by spreading FP reports across many hourly windows.
+ */
+const MAX_FP_COUNT_PER_FINDING = 20;
+// ---------------------------------------------------------------------------
+// Rate limiting — false-positive submissions per finding
+// ---------------------------------------------------------------------------
+const _falsePositiveSubmissions = new Map();
+const FP_RATE_LIMIT = 5; // max 5 false-positive reports per finding per window
+const FP_WINDOW_MS = 3_600_000; // 1 hour window
+/**
+ * Returns true (allowed) only when:
+ *   1. The per-hour sliding window has not been exhausted.
+ *   2. The cumulative all-time FP count for this finding has not reached MAX_FP_COUNT_PER_FINDING.
+ * CWE-799 / OWASP LLM04 (Model Denial of Service via learning system abuse).
+ */
+function checkFalsePositiveRateLimit(findingId) {
+    const now = Date.now();
+    const entry = _falsePositiveSubmissions.get(findingId);
+    if (!entry || now - entry.windowStart > FP_WINDOW_MS) {
+        // Check cumulative cap even when opening a new window.
+        const cumulative = entry?.cumulative ?? 0;
+        if (cumulative >= MAX_FP_COUNT_PER_FINDING) {
+            return { allowed: false, reason: `Cumulative false-positive cap reached for finding ${findingId} (max ${MAX_FP_COUNT_PER_FINDING} all-time). Investigate scanner accuracy before submitting more.` };
+        }
+        _falsePositiveSubmissions.set(findingId, { count: 1, windowStart: now, cumulative: cumulative + 1 });
+        return { allowed: true };
+    }
+    if (entry.cumulative >= MAX_FP_COUNT_PER_FINDING) {
+        return { allowed: false, reason: `Cumulative false-positive cap reached for finding ${findingId} (max ${MAX_FP_COUNT_PER_FINDING} all-time). Investigate scanner accuracy before submitting more.` };
+    }
+    if (entry.count >= FP_RATE_LIMIT) {
+        return { allowed: false, reason: `Rate limit exceeded for false-positive submissions on ${findingId}. Max ${FP_RATE_LIMIT} per hour per finding.` };
+    }
+    entry.count++;
+    entry.cumulative++;
+    return { allowed: true };
+}
+// ---------------------------------------------------------------------------
 // Schemas
 // ---------------------------------------------------------------------------
 export const OutcomeSchema = z.object({
@@ -36,6 +89,26 @@ async function ensureMemoryDir() {
 async function loadStore() {
     try {
         const raw = await readFile(PATTERNS_FILE, "utf-8");
+        // Integrity check: compare SHA-256 of file content against stored sidecar hash.
+        // If the sidecar exists and the hash mismatches, the file may have been tampered with.
+        try {
+            const storedHash = (await readFile(PATTERNS_HASH_FILE, "utf-8")).trim();
+            const actualHash = createHash("sha256").update(raw).digest("hex");
+            // Use timingSafeEqual to prevent timing-oracle inference of the stored hash (CWE-208).
+            const storedBuf = Buffer.from(storedHash, "hex");
+            const actualBuf = Buffer.from(actualHash, "hex");
+            const hashMatch = storedBuf.length === actualBuf.length && timingSafeEqual(storedBuf, actualBuf);
+            if (!hashMatch) {
+                console.warn("[security-mcp] Agent memory patterns.json may have been tampered with. Resetting to empty state.");
+                console.log(JSON.stringify({ event: 'LEARNING_INTEGRITY_VIOLATION', severity: 'CRITICAL', timestamp: new Date().toISOString() }));
+                return { version: 1, updatedAt: new Date().toISOString(), patterns: {} };
+            }
+        }
+        catch (hashErr) {
+            // Sidecar doesn't exist yet (first run after upgrade) — allow and create on next save.
+            if (hashErr.code !== "ENOENT")
+                throw hashErr;
+        }
         return JSON.parse(raw);
     }
     catch {
@@ -45,7 +118,18 @@ async function loadStore() {
 async function saveStore(store) {
     await ensureMemoryDir();
     store.updatedAt = new Date().toISOString();
-    await writeFile(PATTERNS_FILE, JSON.stringify(store, null, 2) + "\n", "utf-8");
+    const content = JSON.stringify(store, null, 2) + "\n";
+    const hash = createHash("sha256").update(content).digest("hex");
+    // Write patterns + sidecar atomically: write to temp files first, then rename
+    // both into place. This prevents a TOCTOU window where an attacker could replace
+    // patterns.json between the two writes and pass integrity on the next load.
+    // CWE-367 (TOCTOU Race Condition) / CAPEC-29.
+    const tmpPatterns = PATTERNS_FILE + ".tmp";
+    const tmpHash = PATTERNS_HASH_FILE + ".tmp";
+    await writeFile(tmpPatterns, content, { encoding: "utf-8", mode: 0o600 });
+    await writeFile(tmpHash, hash + "\n", { encoding: "utf-8", mode: 0o600 });
+    await rename(tmpPatterns, PATTERNS_FILE);
+    await rename(tmpHash, PATTERNS_HASH_FILE);
 }
 // ---------------------------------------------------------------------------
 // Core functions
@@ -56,6 +140,18 @@ async function saveStore(store) {
  */
 export async function recordOutcome(outcome) {
     const validated = OutcomeSchema.parse(outcome);
+    // Rate-limit false-positive submissions to prevent learning-system abuse (OWASP LLM04 / CWE-799).
+    if (validated.falsePositive) {
+        const rlCheck = checkFalsePositiveRateLimit(validated.findingId);
+        if (!rlCheck.allowed) {
+            console.log(JSON.stringify({ event: 'LEARNING_FP_RATE_LIMITED', findingId: validated.findingId, timestamp: new Date().toISOString() }));
+            return {
+                recorded: false,
+                pattern: {},
+                warning: rlCheck.reason ?? "Rate limit exceeded for false-positive submissions on this finding."
+            };
+        }
+    }
     const store = await loadStore();
     const existing = store.patterns[validated.findingId] ?? {
         findingId: validated.findingId,
@@ -119,9 +215,38 @@ export async function recordOutcome(outcome) {
         lastSeen: new Date().toISOString(),
         agentStats: existing.agentStats
     };
+    // Global suppression cap: count how many distinct finding IDs currently have
+    // falsePositiveRate > 0.8 AND sampleSize >= MIN_SAMPLE_SIZE (i.e., are "suppressed").
+    // If this update would push us over MAX_SUPPRESSED_FINDING_TYPES, reject it.
+    // Prevents an attacker from suppressing ALL finding types simultaneously
+    // (OWASP LLM08 — Excessive Agency / MITRE ATLAS AML.T0043).
+    if (validated.falsePositive && updated.falsePositiveRate > 0.8 && updated.sampleSize >= MIN_SAMPLE_SIZE) {
+        const suppressedCount = Object.values(store.patterns).filter((p) => p.findingId !== validated.findingId && p.falsePositiveRate > 0.8 && p.sampleSize >= MIN_SAMPLE_SIZE).length;
+        if (suppressedCount >= MAX_SUPPRESSED_FINDING_TYPES) {
+            console.error(`[security-mcp] SECURITY_ALERT: Global suppression cap reached. ${suppressedCount} finding types already suppressed. Rejecting FP update for ${validated.findingId}. Possible learning-system attack.`);
+            console.log(JSON.stringify({ event: 'LEARNING_SUPPRESSION_DEACTIVATED', findingId: validated.findingId, reason: 'GLOBAL_SUPPRESSION_CAP_EXCEEDED', timestamp: new Date().toISOString() }));
+            return {
+                recorded: false,
+                pattern: updated,
+                warning: `GLOBAL_SUPPRESSION_CAP_EXCEEDED: ${suppressedCount} finding types are already suppressed (max ${MAX_SUPPRESSED_FINDING_TYPES}). Investigate potential learning-system manipulation before submitting more false-positives.`
+            };
+        }
+    }
+    const wasAlreadySuppressed = existing.falsePositiveRate > 0.8 && existing.sampleSize >= MIN_SAMPLE_SIZE;
     store.patterns[validated.findingId] = updated;
     await saveStore(store);
-    return { recorded: true, pattern: updated };
+    // Emit structured audit event when a finding type enters suppressed state for the first time.
+    const isNowSuppressed = updated.falsePositiveRate > 0.8 && updated.sampleSize >= MIN_SAMPLE_SIZE;
+    if (isNowSuppressed && !wasAlreadySuppressed) {
+        console.log(JSON.stringify({ event: 'LEARNING_SUPPRESSION_ACTIVATED', findingId: validated.findingId, falsePositiveRate: updated.falsePositiveRate, sampleSize: updated.sampleSize, timestamp: new Date().toISOString() }));
+    }
+    // Anomaly detection: flag unusually high false-positive rate for this finding.
+    let warning;
+    if (updated.sampleSize > MIN_SAMPLE_SIZE && updated.falsePositiveRate > 0.8) {
+        warning = `LEARNING_ANOMALY_HIGH_FP_RATE: Finding ${validated.findingId} has a false-positive rate of ${Math.round(updated.falsePositiveRate * 100)}% across ${updated.sampleSize} samples. Investigate scanner accuracy.`;
+        console.warn(`[security-mcp] ${warning}`);
+    }
+    return { recorded: true, pattern: updated, ...(warning ? { warning } : {}) };
 }
 /**
  * Get the routing recommendation for a finding type.