security-mcp 1.3.1 → 1.3.3

package/dist/gate/cloud-controls/types.js

@@ -0,0 +1,87 @@
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// src/gate/cloud-controls -> repo root is three levels up (dist/gate/cloud-controls at runtime).
+const PKG_ROOT = resolve(__dirname, "../../..");
+export const CloudProviderSchema = z.enum(["aws", "gcp", "azure"]);
+const DetectSchema = z.object({
+    // How the rule body is matched:
+    //   "terraform"      — HCL resource blocks (supports auto-fix).
+    //   "cloudformation" — CloudFormation/SAM resources in JSON or YAML (detect-only).
+    //   "bicep"          — Bicep resource declarations (detect-only).
+    // Only "terraform" supports auto-remediation; the others are emit-and-fix-manually.
+    target: z.enum(["terraform", "cloudformation", "bicep"]),
+    // Resource type for the target: Terraform "aws_instance", CloudFormation
+    // "AWS::S3::Bucket", or Bicep "Microsoft.Storage/storageAccounts".
+    resourceType: z.string(),
+    // Regex; if it matches inside the resource block the resource is INSECURE.
+    forbid: z.string().optional(),
+    // Regex; if it is ABSENT from the resource block the resource is insecure-by-omission.
+    require: z.string().optional(),
+    // Cross-resource: the resource is insecure unless a companion resource of this
+    // Terraform type exists in the same file and references it by local name.
+    requireCompanionType: z.string().optional()
+});
+const RemediateSchema = z.object({
+    strategy: z.enum(["set-attr", "insert-block", "companion-resource", "manual"]),
+    // Dotted attribute path -> raw HCL value literal. Depth up to 2 (parent.child).
+    // e.g. { "metadata_options.http_tokens": "\"required\"" }.
+    ensure: z.record(z.string(), z.string()).optional(),
+    // Companion resource HCL template. "${name}" is substituted with the offending
+    // resource's local name. Used by strategy "companion-resource".
+    companion: z.string().optional(),
+    // Hardened snippet / guidance emitted when the fix cannot be applied automatically.
+    snippet: z.string().optional()
+});
+const RuleSchema = z.object({
+    ruleId: z.string(),
+    // The attack this misconfiguration enables — why it matters, not "it's non-compliant".
+    threat: z.string(),
+    // Framework labels for context only, e.g. ["AWS FSBP EC2.8", "CIS AWS Foundations Benchmark 5.6"].
+    frameworks: z.array(z.string()).default([]),
+    severity: z.enum(["LOW", "MEDIUM", "HIGH", "CRITICAL"]),
+    title: z.string(),
+    detect: DetectSchema,
+    remediate: RemediateSchema,
+    requiredActions: z.array(z.string()).min(1)
+});
+const RegistrySchema = z.object({
+    version: z.string(),
+    rules: z.array(RuleSchema)
+});
+const PROVIDER_FILES = {
+    aws: "defaults/cloud-controls/aws.json",
+    gcp: "defaults/cloud-controls/gcp.json",
+    azure: "defaults/cloud-controls/azure.json"
+};
+async function loadProvider(cloud) {
+    const path = resolve(PKG_ROOT, PROVIDER_FILES[cloud]);
+    let raw;
+    try {
+        raw = await readFile(path, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const parsed = RegistrySchema.parse(JSON.parse(raw));
+    return parsed.rules.map((rule) => ({ ...rule, cloud }));
+}
+/** Load every cloud-control rule across all providers, tagged with its cloud. */
+export async function loadCloudRules(providers) {
+    const list = providers ?? ["aws", "gcp", "azure"];
+    const groups = await Promise.all(list.map(loadProvider));
+    const seen = new Set();
+    const rules = [];
+    for (const group of groups) {
+        for (const rule of group) {
+            if (seen.has(rule.ruleId)) {
+                throw new Error(`Duplicate cloud-control ruleId: ${rule.ruleId}`);
+            }
+            seen.add(rule.ruleId);
+            rules.push(rule);
+        }
+    }
+    return rules;
+}

package/dist/gate/exceptions.js

@@ -67,7 +67,7 @@ async function readExceptionsJson() {
             throw new Error(`SECURITY_GATE_EXCEPTIONS path '${overridePath}' escapes the project directory`);
         }
         const raw = await readFile(resolved, "utf-8");
-        return { raw, isCiFile: false, warnings };
+        return { raw, isCiFile: false, isOverride: true, source: overridePath, warnings };
     }
     // Project-level CI exceptions file (suppresses self-scan false positives)
     try {
@@ -98,24 +98,41 @@ async function readExceptionsJson() {
                 ]
             });
         }
-        return { raw, isCiFile: true, warnings };
+        return { raw, isCiFile: true, isOverride: false, source: ".github/security-exceptions-ci.json", warnings };
     }
     catch { /* not present — continue */ }
     try {
         const raw = await readFile(join(process.cwd(), ".mcp", "exceptions", "security-exceptions.json"), "utf-8");
-        return { raw, isCiFile: false, warnings };
+        return { raw, isCiFile: false, isOverride: false, source: ".mcp/exceptions/security-exceptions.json", warnings };
     }
     catch {
         const raw = await readFile(join(PKG_ROOT, "defaults", "security-exceptions.json"), "utf-8");
-        return { raw, isCiFile: false, warnings };
+        return { raw, isCiFile: false, isOverride: false, source: "defaults/security-exceptions.json", warnings };
     }
 }
 export async function loadSecurityExceptions() {
-    const { raw, warnings } = await readExceptionsJson();
+    const { raw, warnings, isOverride, isCiFile, source } = await readExceptionsJson();
     const parsed = ExceptionFileSchema.parse(JSON.parse(raw));
     // Fix 3: HMAC verification of exceptions file
     const hmacKey = getExceptionsHmacKey();
     const extraWarnings = [];
+    // #9 fix — opt-in fail-closed: when SECURITY_REQUIRE_SIGNED_EXCEPTIONS is set, an
+    // unsigned (or unverifiable) exceptions file is REJECTED rather than trusted. This
+    // closes the blanket-suppression bypass (an attacker editing an unsigned exceptions
+    // file to silence findings) for operators who enable it. Default-off preserves the
+    // backwards-compatible behavior (and self-scan workflows that use unsigned CI files).
+    const requireSigned = process.env["SECURITY_REQUIRE_SIGNED_EXCEPTIONS"] === "1" ||
+        process.env["SECURITY_REQUIRE_SIGNED_EXCEPTIONS"] === "true";
+    if (requireSigned) {
+        if (!hmacKey) {
+            throw new Error("[loadSecurityExceptions] SECURITY_REQUIRE_SIGNED_EXCEPTIONS is set but SECURITY_POLICY_HMAC_KEY " +
+                "is not configured — cannot verify exceptions integrity. Set a ≥32-byte key and sign the exceptions file.");
+        }
+        if (!parsed.hmacSha256) {
+            throw new Error("[loadSecurityExceptions] SECURITY_REQUIRE_SIGNED_EXCEPTIONS is set but the exceptions file is unsigned " +
+                "(no hmacSha256). Refusing to apply unsigned exceptions. Sign it with the signExceptionsFile helper.");
+        }
+    }
     if (hmacKey) {
         if (!parsed.hmacSha256) {
             extraWarnings.push({
@@ -144,15 +161,17 @@ export async function loadSecurityExceptions() {
     }
     return {
         exceptions: parsed.exceptions,
-        warnings: [...warnings, ...extraWarnings]
+        warnings: [...warnings, ...extraWarnings],
+        integrity: { verified: Boolean(hmacKey && parsed.hmacSha256), isOverride, isCiFile, source }
     };
 }
 export async function applySecurityExceptions(findings, opts) {
-    const { exceptions, warnings } = await loadSecurityExceptions();
+    const { exceptions, warnings, integrity } = await loadSecurityExceptions();
     const active = [];
     const suppressed = [];
     const exceptionFindings = [];
     const activeControlExceptionIds = new Set();
+    const HIGH_SEVERITIES = new Set(["HIGH", "CRITICAL"]);
     for (const entry of exceptions) {
         const expiresAt = new Date(entry.expires_on);
         if (!Number.isNaN(expiresAt.getTime()) && expiresAt.getTime() >= Date.now()) {
@@ -196,12 +215,64 @@ export async function applySecurityExceptions(findings, opts) {
             });
             continue;
         }
+        // #9 fix C/F — DEFAULT POSTURE: an unsigned/unverified exceptions file may NOT suppress
+        // HIGH/CRITICAL findings (it may still suppress LOW/MEDIUM noise). This makes the
+        // dangerous bypass — silently hiding a HIGH/CRITICAL by editing an unsigned file —
+        // fail by default on the override, default (defaults/...), and project (.mcp/...) paths.
+        //   Exemption: the named CI self-scan file `.github/security-exceptions-ci.json` (isCiFile)
+        //   is the project suppressing its OWN intentional test fixtures; its use is already
+        //   surfaced loudly (CI_EXCEPTIONS_IN_LOCAL_SCAN + EXCEPTIONS_UNSIGNED_SUPPRESSION), so it
+        //   stays allowed to avoid breaking self-scan workflows. Sign it to remove the exemption.
+        //   Break-glass: SECURITY_ALLOW_UNSIGNED_HIGH_SUPPRESSION=1 restores the legacy behavior
+        //   on all paths (use only for scanning intentionally-vulnerable fixtures).
+        const allowUnsignedHigh = process.env["SECURITY_ALLOW_UNSIGNED_HIGH_SUPPRESSION"] === "1" ||
+            process.env["SECURITY_ALLOW_UNSIGNED_HIGH_SUPPRESSION"] === "true";
+        if (!integrity.verified && !allowUnsignedHigh && !integrity.isCiFile && HIGH_SEVERITIES.has(finding.severity)) {
+            active.push(finding);
+            exceptionFindings.push({
+                id: "EXCEPTION_UNSIGNED_HIGH_BLOCKED",
+                title: `Unsigned exceptions may not suppress ${finding.severity} finding ${finding.id}`,
+                severity: finding.severity,
+                evidence: [
+                    `Finding: ${finding.id} (${finding.severity})`,
+                    `Exception: ${match.id}`,
+                    `Source: ${integrity.source}${integrity.isOverride ? " (SECURITY_GATE_EXCEPTIONS override)" : ""} — not integrity-verified`
+                ],
+                requiredActions: [
+                    `Sign the exceptions file (set SECURITY_POLICY_HMAC_KEY ≥32 bytes + store its hmacSha256) to suppress ${finding.severity} findings, or resolve the finding. Break-glass for fixtures: SECURITY_ALLOW_UNSIGNED_HIGH_SUPPRESSION=1.`
+                ]
+            });
+            continue;
+        }
         suppressed.push({
             finding,
             exceptionId: match.id,
             expiresOn: match.expires_on
         });
     }
+    // #9 fix B — loud, unsuppressible visibility (default-on, ZERO breakage). When an
+    // UNSIGNED exceptions file suppressed anything, emit one finding (emitted here, AFTER
+    // the suppression loop, so it can never itself be suppressed) so the bypass is never
+    // silent. Severity is intentionally MEDIUM — visible in every report without auto-failing
+    // the gate (which would break legitimate unsigned self-scan workflows). To make unsigned
+    // suppression actually BLOCK, set SECURITY_REQUIRE_SIGNED_EXCEPTIONS=1 (fail-closed).
+    if (!integrity.verified && suppressed.length > 0) {
+        const highHidden = suppressed.filter((s) => HIGH_SEVERITIES.has(s.finding.severity));
+        exceptionFindings.push({
+            id: "EXCEPTIONS_UNSIGNED_SUPPRESSION",
+            title: `${suppressed.length} finding(s) suppressed by an unsigned exceptions file`,
+            severity: "MEDIUM",
+            evidence: [
+                `Source: ${integrity.source}${integrity.isOverride ? " (SECURITY_GATE_EXCEPTIONS override)" : ""}${integrity.isCiFile ? " (CI self-scan)" : ""}`,
+                "File is not integrity-protected (no verified hmacSha256) — its suppressions are not tamper-evident.",
+                `Total suppressed: ${suppressed.length}; HIGH/CRITICAL hidden: ${highHidden.length}`,
+                ...(highHidden.length > 0 ? [`Hidden HIGH/CRITICAL: ${highHidden.map((s) => `${s.finding.id} (${s.finding.severity})`).slice(0, 20).join(", ")}`] : [])
+            ],
+            requiredActions: [
+                "Sign the exceptions file (set SECURITY_POLICY_HMAC_KEY ≥32 bytes and store its hmacSha256) so suppressions are tamper-evident, or set SECURITY_REQUIRE_SIGNED_EXCEPTIONS=1 to reject unsigned exceptions entirely."
+            ]
+        });
+    }
     return {
         findings: active,
         suppressed,

package/dist/gate/findings.js

@@ -3,9 +3,22 @@ export function detectSurfaces(changedFiles) {
     return {
         web: has(/^(app|pages|components|src)\/.*\.(ts|tsx|js|jsx)$/) || has(/^next\.config\./),
         api: has(/^(app\/api|src\/api|api|server)\//),
-        infra: has(/^(infra|terraform|iac|k8s|helm|cloudbuild|\.github\/workflows)\//),
+        infra: has(/^(infra|terraform|iac|k8s|helm|cloudbuild|argo(cd)?|flux|gitops|\.github\/workflows)\//) ||
+            has(/\.(tf|tfvars)(\.json)?$/) ||
+            has(/\.(bicep)$/i) ||
+            has(/(databricks|snowflake|cloudformation|cfn|template\.ya?ml)/i) ||
+            has(/(^|\/)docker-compose(\.[\w-]+)?\.ya?ml$/i),
         mobileIos: has(/^(ios|.*\.xcodeproj|.*\.xcworkspace|.*Info\.plist|Podfile)/),
         mobileAndroid: has(/^(android|.*\/AndroidManifest\.xml|.*\/build\.gradle(\.kts)?|gradle\.properties)/),
-        ai: has(/^(ai|llm|prompt|rag|agents)\//) || has(/(openai|anthropic|vertexai|langchain|llamaindex)/)
+        ai: has(/^(ai|llm|prompt|rag|agents)\//) || has(/(openai|anthropic|vertexai|langchain|llamaindex)/),
+        // Agentic-instruction surface: files an AI coding agent ingests as authority
+        // the moment it opens the repo. Path-based and evaluated for ANY repo, since
+        // a poisoned instruction file is the attack vector even in non-AI projects.
+        agentic: has(/(^|\/)(SKILL|AGENTS|CLAUDE)\.md$/i) ||
+            has(/(^|\/)\.claude\//) ||
+            has(/(^|\/)\.cursor(rules)?(\/|$)/i) ||
+            has(/(^|\/)\.windsurfrules$/i) ||
+            has(/(^|\/)\.github\/copilot-instructions\.md$/i) ||
+            has(/(^|\/)\.mcp\.json$/)
     };
 }

package/dist/gate/policy.js

@@ -34,6 +34,13 @@ import { checkInjectionDeep } from "./checks/injection-deep.js";
 import { checkAuthDeep } from "./checks/auth-deep.js";
 import { checkSupplyChainDeep } from "./checks/supply-chain-deep.js";
 import { checkBusinessLogic } from "./checks/business-logic.js";
+import { checkAgenticInstructions } from "./checks/agentic-instructions.js";
+import { checkAiGovernance } from "./checks/ai-governance.js";
+import { checkIac } from "./checks/iac.js";
+import { checkGitOps } from "./checks/gitops.js";
+import { checkDataPlatform } from "./checks/data-platform.js";
+import { checkDockerDeep } from "./checks/docker-deep.js";
+import { checkCloudControls } from "./checks/cloud-controls.js";
 const PolicySchema = z.object({
     name: z.string(),
     version: z.string(),
@@ -228,7 +235,15 @@ const CHECK_NAMES = [
     "auth-deep",
     "supply-chain-deep",
     "business-logic",
-    "scanners-run"
+    "docker",
+    "scanners-run",
+    "agentic-instructions",
+    "ai-governance",
+    "iac",
+    "gitops",
+    "data-platform",
+    "docker-deep",
+    "cloud-controls"
 ];
 /** Run every applicable security check in parallel and collect findings. */
 async function runAllChecks(opts) {
@@ -263,7 +278,14 @@ async function runAllChecks(opts) {
         checkSupplyChainDeep({ changedFiles }),
         checkBusinessLogic({ changedFiles }),
         runDockerChecks({ changedFiles }),
-        runScanners({ surfaces, changedFiles })
+        runScanners({ surfaces, changedFiles }),
+        surfaces.agentic ? checkAgenticInstructions({ changedFiles }) : Promise.resolve([]),
+        surfaces.ai ? checkAiGovernance({ changedFiles }) : Promise.resolve([]),
+        checkIac({ changedFiles }),
+        checkGitOps({ changedFiles }),
+        checkDataPlatform({ changedFiles }),
+        checkDockerDeep({ changedFiles }),
+        checkCloudControls({ changedFiles })
     ]);
     const findings = [];
     // Fix 5: crashed check modules generate HIGH findings instead of silent console.warn
@@ -408,7 +430,22 @@ export async function runPrGate(opts) {
         baselineDiff = br.diff;
     }
     // Fix 6: read severity_block from policy instead of hardcoding HIGH/CRITICAL
-    const blockedSeverities = policy.severity_block ?? ["HIGH", "CRITICAL"];
+    let blockedSeverities = policy.severity_block ?? ["HIGH", "CRITICAL"];
+    // SECURITY (silent-bypass hardening): when the policy file is NOT integrity-verified
+    // (no SECURITY_POLICY_HMAC_KEY — the default), an attacker who can edit the unsigned
+    // .mcp/policies/security-policy.json could set "severity_block": [] and force every
+    // verdict to PASS with unlimited HIGH/CRITICAL findings. Refuse to let an unverified
+    // policy RELAX the gate below the safe HIGH/CRITICAL floor. To intentionally weaken it,
+    // operators must sign the policy (SECURITY_POLICY_HMAC_KEY + `security-mcp sign-policy`).
+    // When a key IS set, loadPolicy has already HMAC-verified the file (or thrown), so the
+    // operator's configured severity_block is trusted as-is.
+    const policyIntegrityVerified = !!process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!policyIntegrityVerified) {
+        for (const floor of ["HIGH", "CRITICAL"]) {
+            if (!blockedSeverities.includes(floor))
+                blockedSeverities = [...blockedSeverities, floor];
+        }
+    }
     const status = effectiveFindings.some((f) => blockedSeverities.includes(f.severity))
         ? "FAIL" : "PASS";
     const result = {

package/dist/gate/threat-intel.js

@@ -139,6 +139,12 @@ export async function checkActiveExploitation(cveIds, cacheDir) {
     if (cveIds.length === 0) {
         return { kevMatches: [], highEpss: [], failed: false };
     }
+    // CWE-200: the EPSS lookup places this repo's CVE IDs in a cleartext query to
+    // a third party (api.first.org). Operators of private repos can disable all
+    // threat-intel egress with SECURITY_OFFLINE so the unpatched-CVE set never leaves.
+    if (process.env["SECURITY_OFFLINE"] === "1" || process.env["SECURITY_OFFLINE"] === "true") {
+        return { kevMatches: [], highEpss: [], failed: false };
+    }
     try {
         const [kevSet, epssMap] = await Promise.all([
             fetchCisaKev(cacheDir),

package/dist/mcp/audit-chain.js

@@ -62,6 +62,15 @@ function hmacSha256(key, data) {
 function hashFindings(findings) {
     return sha256(JSON.stringify(findings));
 }
+/**
+ * Public helper: compute the canonical SHA-256 of a findings array exactly as
+ * `attestAgent` does. Used by orchestration.mergeAgentFindings to verify that an
+ * agent's findings file matches the hash that agent attested to — i.e. that the
+ * inter-agent payload was not tampered with between attestation and merge.
+ */
+export function computeFindingsHash(findings) {
+    return hashFindings(findings);
+}
 function buildChainPayload(record) {
     return [
         record.agentRunId,

package/dist/mcp/model-router.js

@@ -231,7 +231,7 @@ export const TASK_TIER_MAP = {
 // Storage helpers
 // ---------------------------------------------------------------------------
 async function ensureMemoryDir() {
-    await mkdir(MEMORY_DIR, { recursive: true });
+    await mkdir(MEMORY_DIR, { recursive: true, mode: 0o700 });
 }
 async function loadUsageStore() {
     try {
@@ -245,7 +245,7 @@ async function loadUsageStore() {
 async function saveUsageStore(store) {
     await ensureMemoryDir();
     store.updatedAt = new Date().toISOString();
-    await writeFile(USAGE_FILE, JSON.stringify(store, null, 2) + "\n", "utf-8");
+    await writeFile(USAGE_FILE, JSON.stringify(store, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 async function loadHealthStore() {
     try {
@@ -259,7 +259,7 @@ async function loadHealthStore() {
 async function saveHealthStore(store) {
     await ensureMemoryDir();
     store.updatedAt = new Date().toISOString();
-    await writeFile(HEALTH_FILE, JSON.stringify(store, null, 2) + "\n", "utf-8");
+    await writeFile(HEALTH_FILE, JSON.stringify(store, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 async function loadMaxBudget() {
     try {