security-mcp 1.1.4 → 1.3.3

package/defaults/control-catalog.json

@@ -417,6 +417,30 @@
       "frameworks": ["OWASP LLM Top 10 2025", "NIST AI RMF"],
       "evidence": ["human_in_loop_for_actions", "tool_allowlist_router"]
     },
+    {
+      "id": "AI_AGENTIC_INSTRUCTION_INTEGRITY",
+      "description": "Agentic-instruction files (SKILL.md, .claude, CLAUDE.md, AGENTS.md, .cursorrules, .mcp.json, copilot-instructions) are scanned for prompt-override, exfiltration, tool-poisoning, persistence, hidden-character, and credential-harvest payloads before any AI agent ingests the repository.",
+      "automation": "tooling",
+      "surfaces": ["ai", "agentic"],
+      "frameworks": ["OWASP LLM Top 10 2025", "MITRE ATLAS"],
+      "required_scanners": []
+    },
+    {
+      "id": "AI_LLM_ALGORITHMIC_FAIRNESS",
+      "description": "ML decision systems affecting people carry fairness/bias evaluation (disparate impact, equalized odds, demographic parity) and representativeness evidence.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["EU AI Act", "NIST AI RMF", "ISO 42001"],
+      "evidence": ["fairness_evaluation", "bias_testing_present"]
+    },
+    {
+      "id": "AI_SHADOW_AI_DATA_LEAKAGE",
+      "description": "Secrets and PII are redacted/tokenized before reaching any LLM payload, preventing shadow-AI data leakage to model providers.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["NIST AI RMF", "OWASP LLM Top 10 2025"],
+      "evidence": ["pii_redaction_before_llm", "secret_dlp_guard"]
+    },
     {
       "id": "SLSA_L3_PROVENANCE",
       "description": "Build artifacts have signed SLSA Level 3 provenance from a hermetic, ephemeral CI build.",

package/defaults/security-policy.json

@@ -4,8 +4,8 @@
   "description": "Default security gate policy for security-mcp. Copy to .mcp/policies/security-policy.json and customize for your project.",
   "required_checks": {
     "secrets_scan": { "severity_block": ["HIGH", "CRITICAL"] },
-    "dependency_scan": { "severity_block": ["CRITICAL"] },
-    "sast": { "severity_block": ["CRITICAL"] },
+    "dependency_scan": { "severity_block": ["HIGH", "CRITICAL"] },
+    "sast": { "severity_block": ["HIGH", "CRITICAL"] },
     "iac_scan": { "severity_block": ["HIGH", "CRITICAL"] }
   },
   "environments": {

package/dist/ci/pr-gate.js

@@ -1,3 +1,5 @@
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
 import { runPrGate } from "../gate/policy.js";
 // Allow safe git revision operators (~ and ^) plus ref/path characters. CWE-88.
 const SAFE_REF_RE = /^[a-zA-Z0-9_./~^-]+$/;
@@ -24,7 +26,13 @@ function safeEnvTargets(envVar) {
         return true;
     });
 }
-async function main() {
+/**
+ * Run the policy gate using configuration from environment variables.
+ * Exported so the `security-mcp ci:pr-gate` CLI subcommand can invoke it,
+ * while `node dist/ci/pr-gate.js` (and `npm run ci:pr-gate`) still run it directly.
+ * Exits the process: code 2 when the gate fails, 0 when it passes.
+ */
+export async function runGateFromEnv() {
     const baseRef = safeEnvRef("SECURITY_GATE_BASE_REF", "origin/main");
     const headRef = safeEnvRef("SECURITY_GATE_HEAD_REF", "HEAD");
     const policyPath = process.env.SECURITY_GATE_POLICY || ".mcp/policies/security-policy.json";
@@ -37,7 +45,16 @@ async function main() {
         process.exit(2);
     }
 }
-main().catch((err) => {
-    console.error("security gate crashed:", err);
-    process.exit(3);
-});
+// Auto-run only when executed directly (node dist/ci/pr-gate.js / npm run ci:pr-gate),
+// not when imported by the CLI dispatcher.
+const invokedDirectly = process.argv[1] !== undefined &&
+    fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+if (invokedDirectly) {
+    try {
+        await runGateFromEnv();
+    }
+    catch (err) {
+        console.error("security gate crashed:", err);
+        process.exit(3);
+    }
+}

package/dist/cli/index.js

@@ -12,11 +12,14 @@
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { runInstall } from "./install.js";
 import { main as runServer } from "../mcp/server.js";
 import { notifyIfUpdateAvailable } from "./update.js";
+import { autoHardenTree } from "../gate/cloud-controls/apply.js";
+import { runGateFromEnv } from "../ci/pr-gate.js";
+import { signPolicyFile } from "../gate/policy.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 function getVersion() {
@@ -58,6 +61,9 @@ COMMANDS
   install-global   Install using the globally installed security-mcp binary
   config           Print MCP config JSON for manual editor setup
   doctor           Verify the installation is working correctly
+  autoharden       Auto-apply FSBP/CIS hardening fixes to Terraform (use --dry-run to preview)
+  ci:pr-gate       Run the policy gate against the current diff (for CI/pre-commit)
+  sign-policy      Sign the policy file with SECURITY_POLICY_HMAC_KEY for tamper protection
 
 OPTIONS (install)
   --claude-code        Write config for Claude Code only
@@ -93,6 +99,13 @@ EXAMPLES
   # Verify installation health:
   npx -y security-mcp@latest doctor
 
+  # Run the policy gate in CI (fails the build on HIGH/CRITICAL findings):
+  npx -y security-mcp@latest ci:pr-gate
+
+  # Sign the policy file so tampering is detected at gate startup:
+  export SECURITY_POLICY_HMAC_KEY="$(openssl rand -hex 32)"
+  npx -y security-mcp@latest sign-policy
+
   # Print JSON config snippet:
   npx -y security-mcp@latest config
   security-mcp config --use-global-binary
@@ -179,6 +192,50 @@ function runDoctor() {
         process.exit(1);
     }
 }
+async function runAutoHarden(dryRun) {
+    const report = await autoHardenTree({ write: !dryRun });
+    const verb = dryRun ? "Would apply" : "Applied";
+    process.stdout.write(`\nsecurity-mcp autoharden v${VERSION}\n`);
+    process.stdout.write("=".repeat(40) + "\n\n");
+    process.stdout.write(`${verb} ${report.applied.length} fix(es) across ${report.filesChanged.length} file(s).\n`);
+    for (const fix of report.applied) {
+        process.stdout.write(`  [FIX]    ${fix.ruleId}  ${fix.resource}  (${fix.file})\n`);
+    }
+    for (const m of report.manual) {
+        process.stdout.write(`  [MANUAL] ${m.ruleId}  ${m.resource}  (${m.file}) — ${m.reason}\n`);
+        if (m.snippet)
+            process.stdout.write(`           ${m.snippet}\n`);
+    }
+    if (dryRun)
+        process.stdout.write("\nDry run — no files were modified. Re-run without --dry-run to apply.\n");
+    process.stdout.write("\n");
+}
+// Minimum HMAC key length, mirrors POLICY_HMAC_MIN_KEY_BYTES in src/gate/policy.ts.
+const POLICY_HMAC_MIN_KEY_BYTES = 32;
+function runSignPolicy() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key || Buffer.byteLength(key, "utf-8") < POLICY_HMAC_MIN_KEY_BYTES) {
+        process.stderr.write(`Error: SECURITY_POLICY_HMAC_KEY must be set and at least ${POLICY_HMAC_MIN_KEY_BYTES} bytes.\n` +
+            "Generate one with: openssl rand -hex 32\n");
+        process.exit(1);
+    }
+    const policyPath = process.env["SECURITY_GATE_POLICY"] || ".mcp/policies/security-policy.json";
+    if (!existsSync(policyPath)) {
+        process.stderr.write(`Error: policy file not found at "${policyPath}".\n` +
+            "Create one first (cp node_modules/security-mcp/defaults/security-policy.json .mcp/policies/), " +
+            "or set SECURITY_GATE_POLICY to its path.\n");
+        process.exit(1);
+    }
+    const raw = readFileSync(policyPath, "utf-8");
+    const signature = signPolicyFile(raw, key);
+    // 0o600 — keep the sidecar non-world-readable, consistent with data-at-rest hardening.
+    writeFileSync(`${policyPath}.hmac`, signature + "\n", { mode: 0o600 });
+    process.stdout.write(`\nsecurity-mcp sign-policy v${VERSION}\n`);
+    process.stdout.write("=".repeat(40) + "\n\n");
+    process.stdout.write(`  [SIGNED] ${policyPath}\n`);
+    process.stdout.write(`  [WROTE]  ${policyPath}.hmac\n\n`);
+    process.stdout.write("Commit both files so CI can verify policy integrity at gate startup.\n\n");
+}
 async function main() {
     const args = process.argv.slice(2);
     const useGlobalBinary = args.includes("--use-global-binary");
@@ -191,7 +248,8 @@ async function main() {
         process.exit(0);
     }
     const command = args[0] ?? "serve";
-    if (command === "serve") {
+    if (command === "serve" || command === "ci:pr-gate") {
+        // Non-blocking: keep stdout reserved for protocol/JSON output.
         void notifyIfUpdateAvailable(VERSION);
     }
     else {
@@ -245,6 +303,19 @@ async function main() {
             runDoctor();
             break;
         }
+        case "autoharden": {
+            await runAutoHarden(args.includes("--dry-run"));
+            break;
+        }
+        case "ci:pr-gate": {
+            // Reads SECURITY_GATE_* env vars; exits non-zero when the gate fails.
+            await runGateFromEnv();
+            break;
+        }
+        case "sign-policy": {
+            runSignPolicy();
+            break;
+        }
         default: {
             process.stderr.write(`Unknown command: ${command}\nRun with --help for usage.\n`);
             process.exit(1);

package/dist/cli/install.js

@@ -6,7 +6,6 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { homedir, platform } from "node:os";
-import * as https from "node:https";
 import { fileURLToPath } from "node:url";
 import { runOnboarding, installSecurityTools, commandExists, SECURITY_TOOLS } from "./onboarding.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -172,60 +171,10 @@ function installSkill(dryRun) {
  * Mirrors the same pattern used for security tool binary downloads in onboarding.ts.
  */
 // CWE-22: only alphanumeric, hyphens, and dots allowed in skill names
-const SAFE_SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
-// CWE-918: allowlist for skill download hosts — no user-controlled URLs reach the network
-const ALLOWED_SKILL_HOSTS = new Set(["raw.githubusercontent.com", "github.com"]);
-export async function downloadSkill(skillName, url, dryRun = false) {
-    if (!SAFE_SKILL_NAME_RE.test(skillName)) {
-        process.stdout.write(`  [error] invalid skill name "${skillName}" — skipping download\n`);
-        return;
-    }
-    try {
-        const { hostname } = new URL(url);
-        if (!ALLOWED_SKILL_HOSTS.has(hostname)) {
-            process.stdout.write(`  [error] blocked skill download from unauthorized host "${hostname}"\n`);
-            return;
-        }
-    }
-    catch {
-        process.stdout.write(`  [error] invalid skill URL "${url}" — skipping download\n`);
-        return;
-    }
-    const skillDest = resolveHome(`~/.claude/skills/${skillName}/SKILL.md`);
-    if (dryRun) {
-        process.stdout.write(`  [dry-run] would download skill "${skillName}" from ${url} → ${skillDest}\n`);
-        return;
-    }
-    const MAX_SKILL_BYTES = 512 * 1024; // 512 KB — skills are markdown files
-    const content = await new Promise((resolve) => {
-        const req = https.get(url, { headers: { "User-Agent": "security-mcp" } }, (res) => {
-            if ((res.statusCode ?? 500) >= 400) {
-                res.resume();
-                resolve(null);
-                return;
-            }
-            let body = "";
-            res.setEncoding("utf8");
-            res.on("data", (chunk) => {
-                body += chunk;
-                if (Buffer.byteLength(body, "utf8") > MAX_SKILL_BYTES) {
-                    req.destroy();
-                    resolve(null);
-                }
-            });
-            res.on("end", () => resolve(body));
-        });
-        req.on("error", () => resolve(null));
-        req.setTimeout(10000, () => { req.destroy(); resolve(null); });
-    });
-    if (!content) {
-        process.stdout.write(`  [error] failed to download skill "${skillName}" from ${url}\n`);
-        return;
-    }
-    mkdirSync(dirname(skillDest), { recursive: true });
-    writeFileSync(skillDest, content, "utf-8");
-    process.stdout.write(`  installed skill: ${skillDest}\n`);
-}
+// REMOVED downloadSkill(): an unused, integrity-free network skill installer
+// (no sha256, no content sanitization) that, if ever wired up, would bypass every
+// protection in orchestration.ensureSkill. Skills are bundled in the package and
+// resolved locally by ensureSkill; there is no need for an unauthenticated fetcher.
 /**
  * Eagerly install the orchestrator skill (bundled in the package) plus record
  * its version so orchestration.ensure_skill can detect future updates.

package/dist/cli/onboarding.js

@@ -340,11 +340,21 @@ async function installFromGitHub(tool, os) {
             print(`     Integrity verified (SHA-256 matched).`);
         }
         else {
-            print(`     Warning: checksum file found but no entry for ${fileName} — proceeding without verification.`);
+            print(`     ABORT: checksum file found but no entry for ${fileName} — refusing to install an unverified binary (CWE-494).`);
+            try {
+                unlinkSync(tmpFile);
+            }
+            catch { /* ignore cleanup failure */ }
+            return false;
         }
     }
     else {
-        print(`     Warning: no checksum file in release assets — cannot verify binary integrity.`);
+        print(`     ABORT: no checksum file in release assets — refusing to install an unverified binary (CWE-494).`);
+        try {
+            unlinkSync(tmpFile);
+        }
+        catch { /* ignore cleanup failure */ }
+        return false;
     }
     const destDir = "/usr/local/bin";
     if (tool.tarball) {
@@ -432,12 +442,10 @@ async function tryDnf(tool) {
     print(`     sudo ${mgr} install -y trivy`);
     return run("sudo", [mgr, "install", "-y", "trivy"]);
 }
-async function tryInstallScript(tool) {
-    if (!tool.installScript || !commandExists("curl") || !commandExists("sh"))
-        return false;
-    print(`     Running official install script for ${tool.displayName}...`);
-    return run("bash", ["-c", tool.installScript]);
-}
+// REMOVED (CWE-78/CWE-494): the `curl … | sudo sh` install-script strategy piped an
+// unpinned, live-fetched script into root with no checksum — a compromise of the upstream
+// repo or a MITM yielded root RCE on `security-mcp install`. Tools are now installed only
+// via OS package managers or the checksum-verified GitHub-release path (installFromGitHub).
 async function tryWinget(tool) {
     if (!tool.winget || !commandExists("winget"))
         return false;
@@ -461,10 +469,10 @@ async function installSingleTool(tool, os) {
     print(`\n  Installing ${tool.displayName}...`);
     const strategies = [];
     if (os === "macos") {
-        strategies.push(() => tryBrew(tool), () => tryPip(tool), () => tryGoInstall(tool), () => tryInstallScript(tool), () => installFromGitHub(tool, os));
+        strategies.push(() => tryBrew(tool), () => tryPip(tool), () => tryGoInstall(tool), () => installFromGitHub(tool, os));
     }
     else if (os === "linux") {
-        strategies.push(() => tryApt(tool), () => tryDnf(tool), () => tryPip(tool), () => tryGoInstall(tool), () => tryInstallScript(tool), () => installFromGitHub(tool, os));
+        strategies.push(() => tryApt(tool), () => tryDnf(tool), () => tryPip(tool), () => tryGoInstall(tool), () => installFromGitHub(tool, os));
     }
     else {
         // Windows

package/dist/gate/baseline.js

@@ -5,7 +5,39 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
+// ---------------------------------------------------------------------------
+// HMAC integrity helpers — TM-013 fix
+// ---------------------------------------------------------------------------
+// HMAC-SHA256 requires at least 32 bytes (256 bits) per NIST SP 800-107 §5.3.4.
+const HMAC_MIN_KEY_BYTES = 32;
+/**
+ * Returns the HMAC key from env, or null if not configured.
+ * Throws if the key is present but too short.
+ */
+function getHmacKey() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key)
+        return null;
+    if (Buffer.byteLength(key, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        throw new Error(`SECURITY_POLICY_HMAC_KEY is too short (${Buffer.byteLength(key, "utf-8")} bytes). ` +
+            `Provide at least ${HMAC_MIN_KEY_BYTES} bytes — generate one with: ` +
+            `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
+    return key;
+}
+function signBaseline(json, key) {
+    return createHmac("sha256", key).update(json, "utf-8").digest("hex");
+}
+function verifyBaselineHmac(json, stored, key) {
+    const expected = createHmac("sha256", key).update(json, "utf-8").digest("hex");
+    const storedBuf = Buffer.from(stored, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (storedBuf.length !== expectedBuf.length)
+        return false;
+    return timingSafeEqual(storedBuf, expectedBuf);
+}
 const execFileAsync = promisify(execFile);
 const BASELINE_DIR = join(process.cwd(), ".mcp", "baselines");
 async function ensureDir(dir) {
@@ -32,37 +64,53 @@ export async function getCommitHash() {
 /**
  * Saves a gate result as baseline for the given commit hash.
  * Also updates the latest baseline copy.
+ *
+ * TM-013 fix: When SECURITY_POLICY_HMAC_KEY is set, the serialised payload is
+ * HMAC-SHA256 signed and the signature is stored in the envelope. Unsigned
+ * writes are still permitted when no key is configured (graceful degradation),
+ * but loadBaseline will reject a previously-signed file whose signature no
+ * longer matches (tamper detection).
  */
 export async function saveBaseline(runId, result, commitHash) {
     await ensureDir(BASELINE_DIR);
     const payload = { runId, commitHash, savedAt: new Date().toISOString(), result };
     const json = JSON.stringify(payload, null, 2);
+    // Sign if a key is available
+    const hmacKey = getHmacKey();
+    const envelope = hmacKey
+        ? JSON.stringify({ payload, hmacSha256: signBaseline(json, hmacKey) }, null, 2)
+        : json;
     // Write to temp file then rename (atomic)
     const safehash = commitHash.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 64);
     const targetPath = join(BASELINE_DIR, `${safehash}.json`);
     const latestPath = join(BASELINE_DIR, "latest.json");
-    const tmpPath = `${targetPath}.tmp`;
+    const tmpPath = `${targetPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(tmpPath, json, "utf-8");
+        await writeFile(tmpPath, envelope, "utf-8");
         await rename(tmpPath, targetPath);
     }
     catch {
         // fallback: write directly
-        await writeFile(targetPath, json, "utf-8").catch(() => { });
+        await writeFile(targetPath, envelope, "utf-8").catch(() => { });
     }
     // Update latest (best-effort atomic)
-    const latestTmp = `${latestPath}.tmp`;
+    const latestTmp = `${latestPath}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        await writeFile(latestTmp, json, "utf-8");
+        await writeFile(latestTmp, envelope, "utf-8");
         await rename(latestTmp, latestPath);
     }
     catch {
-        await writeFile(latestPath, json, "utf-8").catch(() => { });
+        await writeFile(latestPath, envelope, "utf-8").catch(() => { });
     }
 }
 /**
  * Loads a baseline by commit hash, or the latest baseline if no hash given.
  * Returns null if no baseline exists or it's corrupted.
+ *
+ * TM-013 fix: If the file is stored in the HMAC envelope format AND
+ * SECURITY_POLICY_HMAC_KEY is configured, the HMAC is verified before the
+ * payload is returned. A tampered baseline (missing or wrong HMAC) is
+ * rejected — the gate will run without a baseline rather than trust forged data.
  */
 export async function loadBaseline(commitHash) {
     await ensureDir(BASELINE_DIR);
@@ -76,7 +124,34 @@ export async function loadBaseline(commitHash) {
     }
     try {
         const raw = await readFile(filePath, "utf-8");
-        const parsed = JSON.parse(raw);
+        const top = JSON.parse(raw);
+        // Detect envelope format (has both "payload" and "hmacSha256")
+        if ("payload" in top && "hmacSha256" in top) {
+            const envelope = top;
+            const hmacKey = getHmacKey();
+            if (hmacKey) {
+                // Re-serialise the inner payload the same way saveBaseline did
+                const expectedInput = JSON.stringify(envelope.payload, null, 2);
+                if (!verifyBaselineHmac(expectedInput, envelope.hmacSha256, hmacKey)) {
+                    console.error("[baseline] HMAC verification failed — baseline may have been tampered. Ignoring.");
+                    return null;
+                }
+            }
+            else {
+                // Key not configured: we can't verify, but we can warn
+                console.warn("[baseline] Baseline is signed but SECURITY_POLICY_HMAC_KEY is not set — skipping HMAC verification.");
+            }
+            return envelope.payload.result ?? null;
+        }
+        // Legacy format (unsigned) — parse directly
+        const parsed = top;
+        const hmacKey = getHmacKey();
+        if (hmacKey) {
+            // A key is configured but the file is unsigned — reject it to prevent
+            // an attacker from stripping the HMAC wrapper to bypass verification.
+            console.error("[baseline] SECURITY_POLICY_HMAC_KEY is set but baseline is unsigned — ignoring to prevent tampering bypass.");
+            return null;
+        }
         return parsed.result ?? null;
     }
     catch {

package/dist/gate/catalog.js

@@ -23,8 +23,16 @@ async function readJsonWithFallback(relPath, fallbackName) {
         ".mcp/catalog/control-catalog.json": "SECURITY_GATE_CONTROL_CATALOG"
     };
     const overrideEnv = overrideEnvMap[relPath];
-    if (overrideEnv && process.env[overrideEnv]) {
-        return await readFile(join(process.cwd(), process.env[overrideEnv]), "utf-8");
+    const overridePath = overrideEnv ? process.env[overrideEnv] : undefined;
+    if (overridePath) {
+        // Guard against path traversal (VULN-003 / CWE-22): resolve() + startsWith() is required;
+        // join() alone normalises '..' but does not prevent escape from the project directory.
+        const cwd = process.cwd();
+        const resolved = resolve(cwd, overridePath);
+        if (resolved !== cwd && !resolved.startsWith(cwd + "/")) {
+            throw new Error(`${overrideEnv} path escapes the project directory`);
+        }
+        return await readFile(resolved, "utf-8");
     }
     try {
         return await readFile(join(process.cwd(), relPath), "utf-8");