security-mcp 1.1.4 → 1.3.3

package/dist/mcp/tool-audit.js

@@ -0,0 +1,193 @@
+/**
+ * Per-tool-call structured audit log.
+ *
+ * Every MCP tool invocation is recorded as one structured JSONL line — the
+ * "one log per tool call, not per session" requirement for agentic systems.
+ * Each record carries the eight mandatory fields:
+ *
+ *   1. timestamp          — ISO-8601 start time of the call
+ *   2. agentId            — the calling agent (args.agentName) or the session id
+ *   3. toolName           — the MCP tool that was invoked
+ *   4. inputParameters    — tool arguments, with secret-bearing keys redacted
+ *   5. outputResult       — outcome + byte size + a truncated, redacted preview
+ *   6. credentialsUsed    — the session credential id (never the secret value)
+ *   7. userContext        — requester/session context
+ *   8. outcomeStatus      — success | error | unauthenticated
+ *
+ * Records are appended to `.mcp/audit/tool-calls.jsonl` (mode 0o600). For a
+ * tamper-proof deployment, point SECURITY_TOOL_AUDIT_LOG at a path backed by an
+ * append-only / write-once sink (e.g. an fs path on a volume with immutability,
+ * or a fifo forwarded to S3 Object Lock). Logging never throws: an audit-sink
+ * failure must not break tool execution.
+ */
+import { appendFileSync, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getSessionId, isAuthRequired } from "./auth.js";
+const AUDIT_LOG_PATH = process.env.SECURITY_TOOL_AUDIT_LOG ?? join(".mcp", "audit", "tool-calls.jsonl");
+const MAX_STRING_LEN = 512;
+const MAX_ARRAY_LEN = 100;
+const MAX_DEPTH = 6;
+const MAX_OUTPUT_PREVIEW = 512;
+const MAX_AGENT_ID_LEN = 256;
+const MAX_AUDIT_BYTES = 50 * 1024 * 1024; // rotate the log once it exceeds 50 MB
+// Keys whose values are credentials/secrets. Substring match (not anchored) so
+// decorated variants are caught: sharedSecret, hmacKey, refreshToken, apiKeyHeader,
+// clientSecretValue, SECURITY_MCP_SHARED_SECRET, x-api-key, etc.
+const SENSITIVE_KEY_RE = /(?:secret|token|passw|pwd|api[_-]?key|apikey|authorization|auth|signature|hmac|private[_-]?key|access[_-]?key|bearer|cookie|credential)/i;
+// Secret-shaped patterns scrubbed from string VALUES (and the output preview),
+// regardless of key name — catches secrets embedded in URLs, command strings, and
+// file contents returned by repo.read_file / repo.search.
+const SECRET_VALUE_PATTERNS = [
+    /AKIA[0-9A-Z]{16}/g, // AWS access key id
+    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/g, // PEM private key header
+    /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, // JWT
+    /gh[pousr]_[A-Za-z0-9]{20,}/g, // GitHub token
+    /xox[baprs]-[A-Za-z0-9-]{10,}/g, // Slack token
+    /(?:secret|token|password|passwd|api[_-]?key|access[_-]?key|private[_-]?key)["']?\s*[:=]\s*["']?[^\s"'`]{6,}/gi, // key=value
+    /\b[A-Fa-f0-9]{40,}\b/g, // long hex (keys/digests)
+    /\b[A-Za-z0-9+/]{40,}={0,2}\b/g // long base64 blob
+];
+function scrubSecrets(s) {
+    let out = s;
+    for (const re of SECRET_VALUE_PATTERNS)
+        out = out.replace(re, "[REDACTED]");
+    return out;
+}
+/** Deep-clone arguments while masking secret keys and capping size. */
+function redact(value, depth = 0) {
+    if (depth > MAX_DEPTH)
+        return "[depth-capped]";
+    if (Array.isArray(value)) {
+        return value.slice(0, MAX_ARRAY_LEN).map((v) => redact(v, depth + 1));
+    }
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = SENSITIVE_KEY_RE.test(k) ? "[REDACTED]" : redact(v, depth + 1);
+        }
+        return out;
+    }
+    if (typeof value === "string") {
+        const scrubbed = scrubSecrets(value);
+        return scrubbed.length > MAX_STRING_LEN ? scrubbed.slice(0, MAX_STRING_LEN) + "…[truncated]" : scrubbed;
+    }
+    return value;
+}
+/** Classify a tool result (the asTextResponse shape) into an outcome status. */
+export function classifyOutcome(result) {
+    try {
+        const text = result?.content?.[0]?.text;
+        if (typeof text === "string") {
+            if (text.startsWith("[security-mcp error]"))
+                return "error";
+            // Match the structured framings only — not the bare word, which could appear in
+            // returned file content (repo.read_file) and poison the outcome field.
+            if (/"error"\s*:\s*"UNAUTHENTICATED"/.test(text))
+                return "unauthenticated";
+            if (/"authenticated"\s*:\s*false/.test(text))
+                return "unauthenticated"; // failed auth attempt
+        }
+    }
+    catch {
+        /* fall through to success */
+    }
+    return "success";
+}
+function summarizeOutput(result, outcome) {
+    let preview = "";
+    let bytes = 0;
+    try {
+        const text = result?.content?.[0]?.text;
+        if (typeof text === "string") {
+            bytes = Buffer.byteLength(text, "utf-8");
+            // Scrub secrets/PII before previewing — tool outputs include repo file contents.
+            const scrubbed = scrubSecrets(text);
+            preview = scrubbed.length > MAX_OUTPUT_PREVIEW ? scrubbed.slice(0, MAX_OUTPUT_PREVIEW) + "…[truncated]" : scrubbed;
+        }
+    }
+    catch {
+        /* leave defaults */
+    }
+    return { outcome, bytes, preview };
+}
+function extractAgentId(args) {
+    if (args && typeof args === "object" && "agentName" in args) {
+        const a = args.agentName;
+        if (typeof a === "string" && a.length > 0)
+            return a.slice(0, MAX_AGENT_ID_LEN);
+    }
+    return (getSessionId() ?? "mcp-session").slice(0, MAX_AGENT_ID_LEN);
+}
+function safeStringify(entry) {
+    // Coerce BigInt so JSON.stringify never throws — a throw would silently drop the
+    // record, which an attacker could weaponize as an audit-evasion primitive.
+    return JSON.stringify(entry, (_k, v) => (typeof v === "bigint" ? v.toString() : v));
+}
+/** Append one audit record. Swallows all errors — never breaks tool execution. */
+function recordToolCall(entry) {
+    try {
+        mkdirSync(dirname(AUDIT_LOG_PATH), { recursive: true, mode: 0o700 });
+        // CWE-400: single-rotation size guard so a tight tool-call loop cannot exhaust disk.
+        try {
+            if (statSync(AUDIT_LOG_PATH).size > MAX_AUDIT_BYTES) {
+                renameSync(AUDIT_LOG_PATH, `${AUDIT_LOG_PATH}.1`);
+            }
+        }
+        catch {
+            /* file absent or not rotatable — ignore */
+        }
+        let line;
+        try {
+            line = safeStringify(entry);
+        }
+        catch {
+            // Last-resort minimal record so a sensitive call is never invisible in the log.
+            line = JSON.stringify({
+                timestamp: entry.timestamp,
+                toolName: entry.toolName,
+                outcomeStatus: entry.outcomeStatus,
+                note: "serialize-failed"
+            });
+        }
+        appendFileSync(AUDIT_LOG_PATH, line + "\n", { encoding: "utf-8", mode: 0o600 });
+    }
+    catch {
+        /* audit sink unavailable — do not interrupt the tool call */
+    }
+}
+/**
+ * Wrap an MCP tool handler so every invocation emits one structured audit
+ * record. The handler's behaviour and return value are unchanged.
+ */
+export function withToolAudit(toolName, handler) {
+    const wrapped = async (args, extra) => {
+        const startedAt = new Date().toISOString();
+        const start = Date.now();
+        let result;
+        let outcome = "success";
+        try {
+            result = await handler(args, extra);
+            outcome = classifyOutcome(result);
+            return result;
+        }
+        catch (err) {
+            outcome = "error";
+            throw err;
+        }
+        finally {
+            const sessionId = getSessionId();
+            recordToolCall({
+                timestamp: startedAt,
+                durationMs: Date.now() - start,
+                agentId: extractAgentId(args),
+                toolName,
+                inputParameters: redact(args),
+                outputResult: summarizeOutput(result, outcome),
+                credentialsUsed: sessionId ?? (isAuthRequired() ? "unauthenticated" : "no-auth-configured"),
+                userContext: `session:${sessionId ?? "anonymous"} pid:${process.pid}`,
+                outcomeStatus: outcome
+            });
+        }
+    };
+    return wrapped;
+}

package/dist/repo/fs.js

@@ -1,5 +1,11 @@
-import { readFile } from "node:fs/promises";
+import { readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
+// Upper bound on the size of any single file the gate will read into memory.
+// A malicious target repo can otherwise ship multi-GB files (or one huge
+// contiguous token) to exhaust memory, or trigger V8 RangeError in the
+// secret-scanner's global-regex passes. 10 MB comfortably covers real source,
+// lockfiles, and minified bundles while bounding blast radius. CWE-400 / CWE-789.
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
 function getWorkspaceRoot() {
     return process.cwd();
 }
@@ -16,5 +22,35 @@ export async function readFileSafe(relPath) {
     if (p !== root && !p.startsWith(rootPrefix)) {
         throw new Error("Path traversal blocked");
     }
+    // Resolve symlinks and verify the real path is also within the workspace.
+    // This prevents symlink traversal attacks where a symlink inside the workspace
+    // points to a file outside it. CWE-61 / CAPEC-132.
+    try {
+        const realResolved = await realpath(p);
+        const realRoot = await realpath(root);
+        const realRootPrefix = realRoot + path.sep;
+        if (realResolved !== realRoot && !realResolved.startsWith(realRootPrefix)) {
+            throw new Error(`Symlink traversal detected: ${relPath} -> ${realResolved}`);
+        }
+    }
+    catch (e) {
+        if (e.code === "ENOENT") {
+            throw new Error(`File not found: ${relPath}`);
+        }
+        if (e.message.includes("Symlink traversal"))
+            throw e;
+        // SECURITY: Any other realpath error (EACCES, ELOOP, etc.) means we could not
+        // verify the real path is within the workspace. Deny rather than fall through,
+        // because readFile() would follow symlinks using the unverified lexical path,
+        // enabling traversal to out-of-workspace targets. CWE-61 / CAPEC-132.
+        throw new Error(`Cannot verify path safety for ${relPath}: ${e.message}`);
+    }
+    // CWE-400/CWE-789: refuse oversized files so a hostile repo cannot exhaust
+    // memory or feed a multi-MB contiguous token into a global regex (RangeError).
+    // Loop-callers (secret/cloud-controls/search scanners) catch this and skip the file.
+    const { size } = await stat(p);
+    if (size > MAX_FILE_BYTES) {
+        throw new Error(`File too large to scan safely: ${relPath} (${size} bytes > ${MAX_FILE_BYTES})`);
+    }
     return await readFile(p, "utf8");
 }

package/dist/repo/search.js

@@ -2,10 +2,30 @@ import fg from "fast-glob";
 import { readFileSafe } from "./fs.js";
 // Maximum allowed regex pattern length. Longer patterns significantly raise
 // the risk of catastrophic backtracking (ReDoS). CWE-1333.
-const MAX_REGEX_LEN = 256;
-// Detects nested quantifiers — the most common ReDoS trigger — without being
-// overly complex itself. Matches patterns like (a+)+, (a*)*, (\w+)+.
-const NESTED_QUANTIFIER_RE = /\([^)]*[+*][^)]*\)[+*?{]/;
+const MAX_REGEX_LEN = 500;
+/**
+ * Detects regex patterns that risk catastrophic backtracking (ReDoS).
+ * Covers nested quantifiers, ambiguous alternation with outer quantifiers,
+ * counted repetition inside groups, and overlapping wildcard groups.
+ * CWE-1333 / MITRE ATT&CK T1499.
+ */
+function isCatastrophicRegex(pattern) {
+    // Original: nested quantifiers like (a+)+, (a*)*, (\w+)+
+    if (/\([^)]*[+*][^)]*\)[+*?{]/.test(pattern))
+        return true;
+    // Ambiguous alternation with outer quantifier: (a|aa)+ or (a|b)+
+    if (/\([^)]*\|[^)]*\)[+*]/.test(pattern))
+        return true;
+    // Counted repetition with nested group: (a{2,})+ or (a{1,3})+
+    if (/\([^)]*\{[^)]*\}[^)]*\)[+*]/.test(pattern))
+        return true;
+    // Overlapping alternatives: (.+)+ or (\w+)+
+    if (/\(\.[+*][^)]*\)[+*]/.test(pattern))
+        return true;
+    if (/\(\\[wWdDsS][+*][^)]*\)[+*]/.test(pattern))
+        return true;
+    return false;
+}
 /**
  * Validates and compiles a user-supplied regex string.
  * Throws if the pattern is dangerously long, contains known ReDoS signatures,
@@ -16,12 +36,16 @@ function compileUserRegex(pattern) {
     if (pattern.length > MAX_REGEX_LEN) {
         throw new Error(`Regex pattern too long (max ${MAX_REGEX_LEN} chars)`);
     }
-    if (NESTED_QUANTIFIER_RE.test(pattern)) {
+    if (isCatastrophicRegex(pattern)) {
         throw new Error("Regex pattern contains nested quantifiers that risk catastrophic backtracking (ReDoS)");
     }
     return new RegExp(pattern, "i"); // throws SyntaxError on invalid patterns
 }
 const MAX_PREVIEW_LEN = 240;
+const SECRET_REDACT_RE = /\b(?:AKIA[A-Z0-9]{16}|sk-[A-Za-z0-9]{32,}|ghp_[A-Za-z0-9]{36,}|xox[baprs]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]{20,}){2})\b/g;
+function redactSecrets(s) {
+    return s.replace(SECRET_REDACT_RE, "[REDACTED]");
+}
 function isHit(line, query, re) {
     return re ? re.test(line) : line.includes(query);
 }
@@ -35,13 +59,14 @@ function scanLines(file, lines, opts, re, matches) {
         matches.push({
             file,
             line: i + 1,
-            preview: line.slice(0, MAX_PREVIEW_LEN)
+            preview: redactSecrets(line.slice(0, MAX_PREVIEW_LEN))
         });
     }
 }
 export async function searchRepo(opts) {
     const files = await fg(["**/*.*"], {
         dot: true,
+        followSymbolicLinks: false, // Prevent glob-based symlink traversal outside workspace root.
         ignore: [
             "**/node_modules/**",
             "**/.git/**",

package/dist/review/store.js

@@ -1,11 +1,11 @@
-import { createHash, createHmac, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 const REVIEW_DIR = path.join(".mcp", "reviews");
 const REPORT_DIR = path.join(".mcp", "reports");
 const CHECKLIST_DEFAULTS_DIR = path.join(path.dirname(path.dirname(path.dirname(new URL(import.meta.url).pathname))), "defaults", "checklists");
 async function ensureDir(dirPath) {
-    await mkdir(dirPath, { recursive: true });
+    await mkdir(dirPath, { recursive: true, mode: 0o700 });
 }
 function reviewPath(runId) {
     return path.join(process.cwd(), REVIEW_DIR, `${runId}.json`);
@@ -15,7 +15,7 @@ function reportPath(runId) {
 }
 async function writeJson(filePath, value) {
     await ensureDir(path.dirname(filePath));
-    await writeFile(filePath, JSON.stringify(value, null, 2) + "\n", "utf-8");
+    await writeFile(filePath, JSON.stringify(value, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 function checklistPath(runId) {
     return path.join(process.cwd(), REVIEW_DIR, `${runId}-checklist.json`);
@@ -40,6 +40,7 @@ const SAFE_SURFACE_RE = /^[a-z][a-z0-9_-]{0,63}$/;
  * Initialize a checklist for a run from the surface template.
  */
 export async function initChecklist(runId, surface) {
+    assertRunId(runId); // CWE-22: validate UUID format before using as filename component
     if (!SAFE_SURFACE_RE.test(surface)) {
         throw new Error(`Invalid surface name "${surface}"`);
     }
@@ -74,6 +75,7 @@ export async function initChecklist(runId, surface) {
  * Mark a checklist item as completed.
  */
 export async function completeChecklistItem(runId, itemId, completedBy, evidence) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -93,6 +95,7 @@ export async function completeChecklistItem(runId, itemId, completedBy, evidence
  * Mark a checklist item as not applicable.
  */
 export async function markChecklistItemNA(runId, itemId, completedBy, reason) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -111,6 +114,7 @@ export async function markChecklistItemNA(runId, itemId, completedBy, reason) {
  * Mark a checklist item as failed.
  */
 export async function failChecklistItem(runId, itemId, completedBy, reason) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -129,6 +133,7 @@ export async function failChecklistItem(runId, itemId, completedBy, reason) {
  * Sign off on a checklist. Requires all non-NA critical items to be completed.
  */
 export async function signOffChecklist(runId, signedOffBy) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -147,6 +152,7 @@ export async function signOffChecklist(runId, signedOffBy) {
  * Read checklist state for a run.
  */
 export async function readChecklist(runId) {
+    assertRunId(runId); // CWE-22
     return readChecklistRaw(runId);
 }
 export async function createReviewRun(opts) {
@@ -157,6 +163,7 @@ export async function createReviewRun(opts) {
         createdAt: now,
         updatedAt: now,
         mode: opts.mode,
+        remediationMode: opts.remediationMode,
         targets: cleanTargets,
         baseRef: opts.baseRef,
         headRef: opts.headRef,
@@ -167,6 +174,7 @@ export async function createReviewRun(opts) {
                 updatedAt: now,
                 details: {
                     mode: opts.mode,
+                    remediationMode: opts.remediationMode,
                     targets: cleanTargets,
                     baseRef: opts.baseRef,
                     headRef: opts.headRef
@@ -202,7 +210,16 @@ export async function updateReviewStep(runId, step, status, details) {
     await writeJson(reviewPath(run.id), run);
     return run;
 }
+// HMAC-SHA256 requires a key of at least 32 bytes (256 bits) to provide full
+// security. Keys shorter than the hash output degrade HMAC to effectively a
+// keyed hash with reduced security margin (NIST SP 800-107 §5.3.4).
+const HMAC_MIN_KEY_BYTES = 32;
 export async function createReviewAttestation(runId, payload, signatureKey) {
+    if (signatureKey !== undefined && Buffer.byteLength(signatureKey, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        throw new Error(`HMAC signature key is too short (${Buffer.byteLength(signatureKey, "utf-8")} bytes). ` +
+            `Provide a key of at least ${HMAC_MIN_KEY_BYTES} bytes (256 bits) — ` +
+            `generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
     const digestInput = JSON.stringify(payload);
     const sha256 = createHash("sha256").update(digestInput).digest("hex");
     const hmacSha256 = signatureKey
@@ -221,3 +238,39 @@ export async function createReviewAttestation(runId, payload, signatureKey) {
         hmacSha256
     };
 }
+/**
+ * Verify a stored attestation HMAC using a timing-safe comparison.
+ * Returns true only if the stored hmacSha256 matches the recomputed value.
+ * Uses timingSafeEqual to prevent timing oracle attacks on the comparison.
+ */
+export async function verifyAttestationHmac(runId, signatureKey) {
+    if (Buffer.byteLength(signatureKey, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        return { valid: false, reason: "Signature key too short — cannot verify." };
+    }
+    let stored;
+    try {
+        const raw = await readFile(reportPath(runId), "utf-8");
+        stored = JSON.parse(raw);
+    }
+    catch {
+        return { valid: false, reason: "Attestation file not found or unreadable." };
+    }
+    const integrity = stored["integrity"];
+    const storedHmac = typeof integrity?.["hmacSha256"] === "string" ? integrity["hmacSha256"] : null;
+    if (!storedHmac) {
+        return { valid: false, reason: "Attestation was not signed — no hmacSha256 field." };
+    }
+    // Recompute HMAC over payload (everything except the integrity wrapper)
+    const { integrity: _stripped, ...payloadOnly } = stored;
+    const digestInput = JSON.stringify(payloadOnly);
+    const expected = createHmac("sha256", signatureKey).update(digestInput).digest("hex");
+    // Timing-safe comparison — prevents oracle attacks that leak the correct HMAC
+    // byte-by-byte via response timing differences (CWE-208).
+    const storedBuf = Buffer.from(storedHmac, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (storedBuf.length !== expectedBuf.length) {
+        return { valid: false, reason: "HMAC length mismatch." };
+    }
+    const match = timingSafeEqual(storedBuf, expectedBuf);
+    return match ? { valid: true } : { valid: false, reason: "HMAC mismatch — attestation may have been tampered." };
+}

package/dist/tests/run.js

@@ -1,7 +1,10 @@
 import assert from "node:assert/strict";
-import { existsSync, readFileSync, rmSync } from "node:fs";
+import { cpSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { runPrGate } from "../gate/policy.js";
+import { autoHardenTree } from "../gate/cloud-controls/apply.js";
+import { checkCloudControls } from "../gate/checks/cloud-controls.js";
 import { createReviewAttestation, createReviewRun, readReviewRun, updateReviewStep } from "../review/store.js";
 function repoPath(...parts) {
     return path.join(process.cwd(), ...parts);
@@ -67,13 +70,115 @@ async function runFixtureGateTests() {
         });
         const ids = result.findings.map((finding) => finding.id);
         assert.ok(ids.includes("AI_OUTPUT_BOUNDS_MISSING"));
+        assert.ok(ids.includes("AI_BIAS_TESTING_ABSENT"));
+    });
+    await withFixture("agentic-malicious", async () => {
+        const result = await runPrGate({
+            mode: "folder_by_folder",
+            targets: ["."],
+            policyPath: ".mcp/policies/security-policy.json"
+        });
+        const ids = result.findings.map((finding) => finding.id);
+        assert.ok(ids.includes("AGENT_INSTRUCTION_OVERRIDE"));
+        assert.ok(ids.includes("AGENT_INSTRUCTION_EXFIL"));
+        assert.ok(ids.includes("AGENT_PERSISTENCE_DIRECTIVE"));
+        assert.ok(ids.includes("AGENT_TOOL_POISONING"));
+        assert.ok(ids.includes("AGENT_CREDENTIAL_HARVEST"));
+        assert.ok(ids.includes("AGENT_MEMORY_POISONING"));
+        assert.ok(ids.includes("AGENT_HIDDEN_INSTRUCTION"));
+        assert.ok(ids.includes("AGENT_REMOTE_INSTRUCTION_LOAD"));
+        assert.ok(ids.includes("AGENT_PERMISSION_ESCALATION"));
+        assert.ok(ids.includes("AGENT_BACKDOOR_INSERT"));
+        assert.ok(ids.includes("AGENT_PROMPT_LEAK"));
+    });
+    await withFixture("aws-insecure", async () => {
+        const result = await runPrGate({
+            mode: "folder_by_folder",
+            targets: ["terraform"],
+            policyPath: ".mcp/policies/security-policy.json"
+        });
+        const ids = result.findings.map((finding) => finding.id);
+        assert.ok(ids.includes("AWS_EC2_IMDSV2_REQUIRED"));
+        assert.ok(ids.includes("AWS_RDS_NOT_PUBLIC"));
+        assert.ok(ids.includes("AWS_S3_BUCKET_NO_PUBLIC_ACL"));
+        assert.ok(ids.includes("AWS_S3_BLOCK_PUBLIC_ACCESS"));
+        assert.ok(ids.includes("AWS_LAMBDA_URL_AUTH_REQUIRED"));
     });
 }
+async function runCloudControlRemediationTests() {
+    const tmp = mkdtempSync(path.join(tmpdir(), "aws-harden-"));
+    const previous = process.cwd();
+    try {
+        cpSync(repoPath("fixtures", "aws-insecure", "terraform"), path.join(tmp, "terraform"), {
+            recursive: true
+        });
+        process.chdir(tmp);
+        const first = await autoHardenTree({ write: true });
+        const appliedIds = new Set(first.applied.map((fix) => fix.ruleId));
+        assert.ok(appliedIds.has("AWS_EC2_IMDSV2_REQUIRED"));
+        assert.ok(appliedIds.has("AWS_RDS_NOT_PUBLIC"));
+        assert.ok(appliedIds.has("AWS_S3_BUCKET_NO_PUBLIC_ACL"));
+        assert.ok(appliedIds.has("AWS_S3_BLOCK_PUBLIC_ACCESS"));
+        assert.ok(appliedIds.has("AWS_KMS_KEY_ROTATION"));
+        assert.ok(appliedIds.has("AWS_LAMBDA_URL_AUTH_REQUIRED"));
+        const hardened = readFileSync(path.join(tmp, "terraform", "main.tf"), "utf-8");
+        assert.match(hardened, /http_tokens\s*=\s*"required"/);
+        assert.match(hardened, /publicly_accessible\s*=\s*false/);
+        assert.match(hardened, /acl\s*=\s*"private"/);
+        assert.match(hardened, /enable_key_rotation\s*=\s*true/);
+        assert.match(hardened, /authorization_type\s*=\s*"AWS_IAM"/);
+        assert.match(hardened, /aws_s3_bucket_public_access_block/);
+        // Idempotent: a second pass over the now-hardened tree applies nothing.
+        const second = await autoHardenTree({ write: true });
+        assert.equal(second.applied.length, 0);
+        assert.equal(second.filesChanged.length, 0);
+    }
+    finally {
+        process.chdir(previous);
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
+async function runNestedRemediationTests() {
+    const tmp = mkdtempSync(path.join(tmpdir(), "cloud-harden-"));
+    const previous = process.cwd();
+    try {
+        cpSync(repoPath("fixtures", "gcp-insecure", "terraform"), path.join(tmp, "gcp"), {
+            recursive: true
+        });
+        cpSync(repoPath("fixtures", "azure-insecure", "terraform"), path.join(tmp, "azure"), {
+            recursive: true
+        });
+        process.chdir(tmp);
+        const report = await autoHardenTree({ write: true });
+        const appliedIds = new Set(report.applied.map((fix) => fix.ruleId));
+        // GCP: depth-3 nested replace + insert into existing settings/ip_configuration blocks.
+        assert.ok(appliedIds.has("GCP_SQL_NO_PUBLIC_IP"));
+        assert.ok(appliedIds.has("GCP_SQL_REQUIRE_SSL"));
+        assert.ok(appliedIds.has("GCP_STORAGE_UNIFORM_ACCESS"));
+        // Azure.
+        assert.ok(appliedIds.has("AZURE_STORAGE_HTTPS_ONLY"));
+        assert.ok(appliedIds.has("AZURE_KV_PURGE_PROTECTION"));
+        const gcp = readFileSync(path.join(tmp, "gcp", "main.tf"), "utf-8");
+        assert.match(gcp, /ipv4_enabled\s*=\s*false/);
+        assert.match(gcp, /require_ssl\s*=\s*true/);
+        const azure = readFileSync(path.join(tmp, "azure", "main.tf"), "utf-8");
+        assert.match(azure, /enable_https_traffic_only\s*=\s*true/);
+        assert.match(azure, /purge_protection_enabled\s*=\s*true/);
+        // Idempotent across both providers.
+        const second = await autoHardenTree({ write: true });
+        assert.equal(second.applied.length, 0);
+    }
+    finally {
+        process.chdir(previous);
+        rmSync(tmp, { recursive: true, force: true });
+    }
+}
 async function runReviewWorkflowTests() {
     cleanupFixtureReviewArtifacts("web-insecure");
     await withFixture("web-insecure", async () => {
         const run = await createReviewRun({
             mode: "folder_by_folder",
+            remediationMode: "auto_apply",
             targets: ["src"]
         });
         await updateReviewStep(run.id, "scan_strategy", "completed", { mode: "folder_by_folder", targets: ["src"] });
@@ -91,9 +196,27 @@ async function runReviewWorkflowTests() {
     });
     cleanupFixtureReviewArtifacts("web-insecure");
 }
+async function runCfnBicepDetectionTests() {
+    await withFixture("cfn-insecure", async () => {
+        const ids = new Set((await checkCloudControls({ changedFiles: [] })).map((f) => f.id));
+        assert.ok(ids.has("CFN_S3_NO_PUBLIC_ACL"));
+        assert.ok(ids.has("CFN_RDS_NOT_PUBLIC"));
+        assert.ok(ids.has("CFN_RDS_STORAGE_ENCRYPTED"));
+        assert.ok(ids.has("CFN_SG_OPEN_INGRESS"));
+    });
+    await withFixture("bicep-insecure", async () => {
+        const ids = new Set((await checkCloudControls({ changedFiles: [] })).map((f) => f.id));
+        assert.ok(ids.has("BICEP_STORAGE_HTTPS_ONLY"));
+        assert.ok(ids.has("BICEP_STORAGE_MIN_TLS"));
+        assert.ok(ids.has("BICEP_SQL_NO_PUBLIC"));
+    });
+}
 async function main() {
     await runPromptConformanceTests();
     await runFixtureGateTests();
+    await runCloudControlRemediationTests();
+    await runNestedRemediationTests();
+    await runCfnBicepDetectionTests();
     await runReviewWorkflowTests();
     console.log("security-mcp tests passed");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-mcp",
-  "version": "1.1.4",
+  "version": "1.3.3",
   "description": "AI security MCP server and enforcement gate for Claude Code, Cursor, GitHub Copilot, Codex, Replit, and any MCP-compatible editor. Applies OWASP, MITRE ATT&CK, NIST, Zero Trust, PCI DSS, SOC 2, and ISO 27001.",
   "type": "module",
   "license": "MIT",
@@ -8,7 +8,7 @@
   "homepage": "https://github.com/AbrahamOO/security-mcp#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/AbrahamOO/security-mcp.git"
+    "url": "git+https://github.com/AbrahamOO/security-mcp.git"
   },
   "bugs": {
     "url": "https://github.com/AbrahamOO/security-mcp/issues"
@@ -41,7 +41,7 @@
     "model-context-protocol"
   ],
   "bin": {
-    "security-mcp": "./dist/cli/index.js"
+    "security-mcp": "dist/cli/index.js"
   },
   "files": [
     "dist/",
@@ -61,24 +61,24 @@
     "test": "npm run build && node dist/tests/run.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "execa": "^9.5.2",
     "fast-glob": "^3.3.3",
     "picomatch": "^4.0.4",
     "zod": "^3.24.1"
   },
   "overrides": {
-    "express-rate-limit": "^8.2.2",
-    "hono": "^4.12.7"
+    "express-rate-limit": "8.5.2",
+    "hono": "4.12.23"
   },
   "devDependencies": {
     "@eslint/js": "^9.22.0",
-    "@types/node": "^22.13.5",
-    "@types/picomatch": "^4.0.2",
+    "@types/node": "^24.12.4",
+    "@types/picomatch": "^4.0.3",
     "eslint": "^9.22.0",
     "globals": "^16.0.0",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.26.0"
+    "typescript-eslint": "^8.60.0"
   },
   "engines": {
     "node": ">=20"