security-mcp 1.1.4 → 1.3.3

package/dist/mcp/model-router.js

@@ -35,9 +35,28 @@ const MEMORY_DIR = join(".mcp", "memory");
 const USAGE_FILE = join(MEMORY_DIR, "model-usage.json");
 const HEALTH_FILE = join(MEMORY_DIR, "provider-health.json");
 const POLICY_FILE = join(".mcp", "policies", "security-policy.json");
-const DEFAULT_BUDGET_USD = 5.0;
+const DEFAULT_BUDGET_USD = 5;
 const CIRCUIT_BREAKER_THRESHOLD = 3; // failures before circuit opens
 const CIRCUIT_BREAKER_COOLDOWN_MS = 60_000; // 60 seconds
+// ---------------------------------------------------------------------------
+// Rate limiting — recordProviderFailure to prevent circuit-breaker manipulation
+// ---------------------------------------------------------------------------
+const _providerFailureSubmissions = new Map();
+const FAILURE_RATE_LIMIT = 5; // max 5 failure reports per provider per window
+const FAILURE_WINDOW_MS = 300_000; // 5 minute window
+export function recordProviderFailureRateLimited(providerName) {
+    const now = Date.now();
+    const entry = _providerFailureSubmissions.get(providerName);
+    if (!entry || now - entry.windowStart > FAILURE_WINDOW_MS) {
+        _providerFailureSubmissions.set(providerName, { count: 1, windowStart: now });
+        return { allowed: true };
+    }
+    if (entry.count >= FAILURE_RATE_LIMIT) {
+        return { allowed: false, reason: `Rate limit exceeded: max ${FAILURE_RATE_LIMIT} failure reports per provider per 5 minutes` };
+    }
+    entry.count++;
+    return { allowed: true };
+}
 /**
  * Full model registry across all providers.
  * Pricing sourced from public pricing pages (approximate, for routing decisions only).
@@ -57,8 +76,8 @@ export const MODEL_REGISTRY = [
         modelId: "claude-sonnet-4-6",
         provider: "anthropic",
         capabilityTier: "standard",
-        inputPer1M: 3.0,
-        outputPer1M: 15.0,
+        inputPer1M: 3,
+        outputPer1M: 15,
         label: "Claude Sonnet 4.6"
     },
     // OpenAI — GPT
@@ -67,15 +86,15 @@ export const MODEL_REGISTRY = [
         provider: "openai",
         capabilityTier: "light",
         inputPer1M: 0.15,
-        outputPer1M: 0.60,
+        outputPer1M: 0.6,
         label: "GPT-4o Mini"
     },
     {
         modelId: "gpt-4o",
         provider: "openai",
         capabilityTier: "standard",
-        inputPer1M: 2.50,
-        outputPer1M: 10.0,
+        inputPer1M: 2.5,
+        outputPer1M: 10,
         label: "GPT-4o"
     },
     // Google — Gemini
@@ -84,7 +103,7 @@ export const MODEL_REGISTRY = [
         provider: "google",
         capabilityTier: "light",
         inputPer1M: 0.075,
-        outputPer1M: 0.30,
+        outputPer1M: 0.3,
         label: "Gemini 1.5 Flash"
     },
     {
@@ -92,7 +111,7 @@ export const MODEL_REGISTRY = [
         provider: "google",
         capabilityTier: "standard",
         inputPer1M: 1.25,
-        outputPer1M: 5.0,
+        outputPer1M: 5,
         label: "Gemini 1.5 Pro"
     },
     // Cohere — Command R
@@ -101,17 +120,44 @@ export const MODEL_REGISTRY = [
         provider: "cohere",
         capabilityTier: "light",
         inputPer1M: 0.15,
-        outputPer1M: 0.60,
+        outputPer1M: 0.6,
         label: "Command R"
     },
     {
         modelId: "command-r-plus",
         provider: "cohere",
         capabilityTier: "standard",
-        inputPer1M: 2.50,
-        outputPer1M: 10.0,
+        inputPer1M: 2.5,
+        outputPer1M: 10,
         label: "Command R+"
     },
+    // Anthropic — Claude Opus (advanced tier, opt-in via advanced_task_preference in policy)
+    {
+        modelId: "claude-opus-4-8",
+        provider: "anthropic",
+        capabilityTier: "advanced",
+        inputPer1M: 15,
+        outputPer1M: 75,
+        label: "Claude Opus 4.8"
+    },
+    // OpenAI — o1 (advanced tier)
+    {
+        modelId: "o1",
+        provider: "openai",
+        capabilityTier: "advanced",
+        inputPer1M: 15,
+        outputPer1M: 60,
+        label: "OpenAI o1"
+    },
+    // Google — Gemini 2.0 Flash (advanced tier)
+    {
+        modelId: "gemini-2.0-flash-thinking-exp",
+        provider: "google",
+        capabilityTier: "advanced",
+        inputPer1M: 0,
+        outputPer1M: 0,
+        label: "Gemini 2.0 Flash Thinking (experimental)"
+    },
     // Local — Ollama (zero cost, requires Ollama at localhost:11434)
     {
         modelId: "llama3",
@@ -185,7 +231,7 @@ export const TASK_TIER_MAP = {
 // Storage helpers
 // ---------------------------------------------------------------------------
 async function ensureMemoryDir() {
-    await mkdir(MEMORY_DIR, { recursive: true });
+    await mkdir(MEMORY_DIR, { recursive: true, mode: 0o700 });
 }
 async function loadUsageStore() {
     try {
@@ -199,7 +245,7 @@ async function loadUsageStore() {
 async function saveUsageStore(store) {
     await ensureMemoryDir();
     store.updatedAt = new Date().toISOString();
-    await writeFile(USAGE_FILE, JSON.stringify(store, null, 2) + "\n", "utf-8");
+    await writeFile(USAGE_FILE, JSON.stringify(store, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 async function loadHealthStore() {
     try {
@@ -213,7 +259,7 @@ async function loadHealthStore() {
 async function saveHealthStore(store) {
     await ensureMemoryDir();
     store.updatedAt = new Date().toISOString();
-    await writeFile(HEALTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf-8");
+    await writeFile(HEALTH_FILE, JSON.stringify(store, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 async function loadMaxBudget() {
     try {
@@ -235,6 +281,16 @@ async function loadPreferredProviders() {
         return null;
     }
 }
+async function loadAdvancedTaskPreferences() {
+    try {
+        const raw = await readFile(POLICY_FILE, "utf-8");
+        const policy = JSON.parse(raw);
+        return policy.model_budget?.advanced_task_preference ?? [];
+    }
+    catch {
+        return [];
+    }
+}
 // ---------------------------------------------------------------------------
 // Circuit breaker helpers
 // ---------------------------------------------------------------------------
@@ -265,12 +321,31 @@ function legacyTier(capTier) {
  * Select the cheapest healthy model that meets the capability requirement for
  * the given task type. Respects preferred_providers policy and circuit breakers.
  *
- * @param requiredTier  Minimum capability tier for the task.
- * @param health        Current provider health store.
- * @param preferred     Optional ordered list of preferred providers.
- * @returns             [chosen model, failoverUsed]
+ * @param requiredTier    Minimum capability tier for the task.
+ * @param health          Current provider health store.
+ * @param preferred       Optional ordered list of preferred providers.
+ * @param preferAdvanced  If true, try advanced-tier models first, fall back to standard.
+ * @returns               [chosen model, failoverUsed]
  */
-function selectModel(requiredTier, health, preferred) {
+function selectModel(requiredTier, health, preferred, preferAdvanced = false) {
+    // If advanced is preferred, try advanced-tier models first. Fall back gracefully to
+    // standard if none are healthy or registered — zero impact for users without Opus/o1.
+    if (preferAdvanced) {
+        const advancedCandidates = MODEL_REGISTRY.filter((m) => m.capabilityTier === "advanced");
+        const healthyAdvanced = advancedCandidates.filter((m) => !isCircuitOpen(health.providers[m.provider]));
+        if (healthyAdvanced.length > 0) {
+            const pool = preferred
+                ? [
+                    ...healthyAdvanced.filter((m) => preferred.includes(m.provider)),
+                    ...healthyAdvanced.filter((m) => !preferred.includes(m.provider))
+                ]
+                : healthyAdvanced;
+            pool.sort((a, b) => combinedCost(a) - combinedCost(b));
+            if (pool.length > 0)
+                return [pool[0], false];
+        }
+        // No advanced model available — fall through to standard selection silently.
+    }
     // Candidates: all models meeting the capability floor.
     const candidates = MODEL_REGISTRY.filter((m) => meetsCapabilityFloor(m, requiredTier));
     // Separate healthy vs. circuit-open providers.
@@ -304,14 +379,16 @@ function selectModel(requiredTier, health, preferred) {
  * Falls back to next-cheapest provider on circuit breaker open.
  */
 export async function getModelForTask(taskType, _opts) {
-    const [store, health, maxBudget, preferred] = await Promise.all([
+    const [store, health, maxBudget, preferred, advancedPrefs] = await Promise.all([
         loadUsageStore(),
         loadHealthStore(),
         loadMaxBudget(),
-        loadPreferredProviders()
+        loadPreferredProviders(),
+        loadAdvancedTaskPreferences()
     ]);
     const requiredTier = TASK_CAPABILITY_MAP[taskType];
-    const [chosen, failoverUsed] = selectModel(requiredTier, health, preferred);
+    const preferAdvanced = advancedPrefs.includes(taskType);
+    const [chosen, failoverUsed] = selectModel(requiredTier, health, preferred, preferAdvanced);
     const spent = store.totalSpentUsd;
     const remaining = maxBudget - spent;
     const utilizationPct = maxBudget > 0 ? (spent / maxBudget) * 100 : 0;
@@ -326,6 +403,39 @@ export async function getModelForTask(taskType, _opts) {
         budgetStatus = "ok";
     }
     const rationale = buildRationale(taskType, requiredTier, chosen, failoverUsed, preferred);
+    // Determine whether all providers were circuit-open (best-effort fallback path).
+    const allProviders = ["anthropic", "openai", "google", "cohere", "local"];
+    const allCircuitsOpen = allProviders.every((p) => isCircuitOpen(health.providers[p]));
+    // ISO 42001 §9.1 — emit structured audit log for every routing decision.
+    let routingReason;
+    if (allCircuitsOpen) {
+        routingReason = "circuit_open_fallback";
+    }
+    else if (failoverUsed) {
+        routingReason = "capability_match";
+    }
+    else {
+        routingReason = "cost_optimized";
+    }
+    console.log(JSON.stringify({
+        event: "MODEL_ROUTING_DECISION",
+        timestamp: new Date().toISOString(),
+        taskType,
+        selectedModel: chosen.modelId,
+        selectedProvider: chosen.provider,
+        reason: routingReason,
+        circuitState: allCircuitsOpen ? "FALLBACK" : "NORMAL",
+    }));
+    // Additional high-severity audit entry for the circuit-breaker fallback path.
+    if (allCircuitsOpen) {
+        console.warn(JSON.stringify({
+            event: "MODEL_ROUTING_CIRCUIT_FALLBACK",
+            timestamp: new Date().toISOString(),
+            reason: "ALL_PROVIDERS_CIRCUIT_OPEN",
+            fallbackModel: chosen.modelId,
+            severity: "HIGH",
+        }));
+    }
     return {
         model: chosen.modelId,
         provider: chosen.provider,
@@ -358,8 +468,8 @@ function buildRationale(taskType, required, chosen, failoverUsed, preferred) {
 export async function trackUsage(usage) {
     const [store, health] = await Promise.all([loadUsageStore(), loadHealthStore()]);
     const model = MODEL_REGISTRY.find((m) => m.modelId === usage.model);
-    const inputRate = model?.inputPer1M ?? (usage.tier === "haiku" ? 0.25 : 3.0);
-    const outputRate = model?.outputPer1M ?? (usage.tier === "haiku" ? 1.25 : 15.0);
+    const inputRate = model?.inputPer1M ?? (usage.tier === "haiku" ? 0.25 : 3);
+    const outputRate = model?.outputPer1M ?? (usage.tier === "haiku" ? 1.25 : 15);
     const estimatedCost = (usage.inputTokens / 1_000_000) * inputRate +
         (usage.outputTokens / 1_000_000) * outputRate;
     const record = {
@@ -389,8 +499,13 @@ export async function trackUsage(usage) {
 /**
  * Record a provider failure (connection error, rate limit, auth failure).
  * Opens circuit breaker after CIRCUIT_BREAKER_THRESHOLD consecutive failures.
+ * Rate-limited to prevent deliberate circuit-breaker manipulation (max 5 per provider per 5 min).
  */
 export async function recordProviderFailure(provider) {
+    const rateCheck = recordProviderFailureRateLimited(provider);
+    if (!rateCheck.allowed) {
+        return { recorded: false, reason: rateCheck.reason };
+    }
     const health = await loadHealthStore();
     const now = new Date();
     const state = health.providers[provider] ?? {
@@ -407,6 +522,28 @@ export async function recordProviderFailure(provider) {
     }
     health.providers[provider] = state;
     await saveHealthStore(health);
+    // Circuit-state audit: warn and emit structured audit record if all known providers are circuit-open.
+    // Deliberate manipulation requires only CIRCUIT_BREAKER_THRESHOLD (3) failures per provider × 5 providers
+    // = 15 calls, constrained to max 5 per provider per 5-min window. Log at ERROR level so SIEM picks this up.
+    // MITRE ATLAS AML.T0040 (ML Model Inference API) — circuit-breaker exhaustion attack.
+    const allProviders = ["anthropic", "openai", "google", "cohere", "local"];
+    const allProvidersDown = allProviders.every((p) => isCircuitOpen(health.providers[p]));
+    if (allProvidersDown) {
+        // Determine which fallback model will be used (cheapest in registry, circuit ignored).
+        const fallbackCandidates = MODEL_REGISTRY.filter((m) => m.provider === "anthropic" && m.capabilityTier === "standard");
+        const fallbackModel = fallbackCandidates[0]?.modelId ?? "unknown";
+        console.error(JSON.stringify({
+            severity: "CRITICAL",
+            event: "ALL_PROVIDERS_CIRCUIT_OPEN",
+            message: "All AI providers are circuit-open. Routing to fallback model. This may indicate deliberate circuit-breaker manipulation.",
+            fallbackModel,
+            timestamp: new Date().toISOString(),
+            failingProvider: provider,
+            mitre: "AML.T0040",
+            action: "Manual investigation required. Call security.reset_provider_circuit after confirming provider health."
+        }));
+    }
+    return { recorded: true };
 }
 /**
  * Return health status for all providers — circuit breaker state and call counts.