security-mcp 1.3.1 → 1.3.3

package/defaults/control-catalog.json

@@ -417,6 +417,30 @@
       "frameworks": ["OWASP LLM Top 10 2025", "NIST AI RMF"],
       "evidence": ["human_in_loop_for_actions", "tool_allowlist_router"]
     },
+    {
+      "id": "AI_AGENTIC_INSTRUCTION_INTEGRITY",
+      "description": "Agentic-instruction files (SKILL.md, .claude, CLAUDE.md, AGENTS.md, .cursorrules, .mcp.json, copilot-instructions) are scanned for prompt-override, exfiltration, tool-poisoning, persistence, hidden-character, and credential-harvest payloads before any AI agent ingests the repository.",
+      "automation": "tooling",
+      "surfaces": ["ai", "agentic"],
+      "frameworks": ["OWASP LLM Top 10 2025", "MITRE ATLAS"],
+      "required_scanners": []
+    },
+    {
+      "id": "AI_LLM_ALGORITHMIC_FAIRNESS",
+      "description": "ML decision systems affecting people carry fairness/bias evaluation (disparate impact, equalized odds, demographic parity) and representativeness evidence.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["EU AI Act", "NIST AI RMF", "ISO 42001"],
+      "evidence": ["fairness_evaluation", "bias_testing_present"]
+    },
+    {
+      "id": "AI_SHADOW_AI_DATA_LEAKAGE",
+      "description": "Secrets and PII are redacted/tokenized before reaching any LLM payload, preventing shadow-AI data leakage to model providers.",
+      "automation": "evidence",
+      "surfaces": ["ai"],
+      "frameworks": ["NIST AI RMF", "OWASP LLM Top 10 2025"],
+      "evidence": ["pii_redaction_before_llm", "secret_dlp_guard"]
+    },
     {
       "id": "SLSA_L3_PROVENANCE",
       "description": "Build artifacts have signed SLSA Level 3 provenance from a hermetic, ephemeral CI build.",

package/dist/ci/pr-gate.js

@@ -1,3 +1,5 @@
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
 import { runPrGate } from "../gate/policy.js";
 // Allow safe git revision operators (~ and ^) plus ref/path characters. CWE-88.
 const SAFE_REF_RE = /^[a-zA-Z0-9_./~^-]+$/;
@@ -24,7 +26,13 @@ function safeEnvTargets(envVar) {
         return true;
     });
 }
-async function main() {
+/**
+ * Run the policy gate using configuration from environment variables.
+ * Exported so the `security-mcp ci:pr-gate` CLI subcommand can invoke it,
+ * while `node dist/ci/pr-gate.js` (and `npm run ci:pr-gate`) still run it directly.
+ * Exits the process: code 2 when the gate fails, 0 when it passes.
+ */
+export async function runGateFromEnv() {
     const baseRef = safeEnvRef("SECURITY_GATE_BASE_REF", "origin/main");
     const headRef = safeEnvRef("SECURITY_GATE_HEAD_REF", "HEAD");
     const policyPath = process.env.SECURITY_GATE_POLICY || ".mcp/policies/security-policy.json";
@@ -37,7 +45,16 @@ async function main() {
         process.exit(2);
     }
 }
-main().catch((err) => {
-    console.error("security gate crashed:", err);
-    process.exit(3);
-});
+// Auto-run only when executed directly (node dist/ci/pr-gate.js / npm run ci:pr-gate),
+// not when imported by the CLI dispatcher.
+const invokedDirectly = process.argv[1] !== undefined &&
+    fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+if (invokedDirectly) {
+    try {
+        await runGateFromEnv();
+    }
+    catch (err) {
+        console.error("security gate crashed:", err);
+        process.exit(3);
+    }
+}

package/dist/cli/index.js

@@ -12,11 +12,14 @@
 import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { runInstall } from "./install.js";
 import { main as runServer } from "../mcp/server.js";
 import { notifyIfUpdateAvailable } from "./update.js";
+import { autoHardenTree } from "../gate/cloud-controls/apply.js";
+import { runGateFromEnv } from "../ci/pr-gate.js";
+import { signPolicyFile } from "../gate/policy.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 function getVersion() {
@@ -58,6 +61,9 @@ COMMANDS
   install-global   Install using the globally installed security-mcp binary
   config           Print MCP config JSON for manual editor setup
   doctor           Verify the installation is working correctly
+  autoharden       Auto-apply FSBP/CIS hardening fixes to Terraform (use --dry-run to preview)
+  ci:pr-gate       Run the policy gate against the current diff (for CI/pre-commit)
+  sign-policy      Sign the policy file with SECURITY_POLICY_HMAC_KEY for tamper protection
 
 OPTIONS (install)
   --claude-code        Write config for Claude Code only
@@ -93,6 +99,13 @@ EXAMPLES
   # Verify installation health:
   npx -y security-mcp@latest doctor
 
+  # Run the policy gate in CI (fails the build on HIGH/CRITICAL findings):
+  npx -y security-mcp@latest ci:pr-gate
+
+  # Sign the policy file so tampering is detected at gate startup:
+  export SECURITY_POLICY_HMAC_KEY="$(openssl rand -hex 32)"
+  npx -y security-mcp@latest sign-policy
+
   # Print JSON config snippet:
   npx -y security-mcp@latest config
   security-mcp config --use-global-binary
@@ -179,6 +192,50 @@ function runDoctor() {
         process.exit(1);
     }
 }
+async function runAutoHarden(dryRun) {
+    const report = await autoHardenTree({ write: !dryRun });
+    const verb = dryRun ? "Would apply" : "Applied";
+    process.stdout.write(`\nsecurity-mcp autoharden v${VERSION}\n`);
+    process.stdout.write("=".repeat(40) + "\n\n");
+    process.stdout.write(`${verb} ${report.applied.length} fix(es) across ${report.filesChanged.length} file(s).\n`);
+    for (const fix of report.applied) {
+        process.stdout.write(`  [FIX]    ${fix.ruleId}  ${fix.resource}  (${fix.file})\n`);
+    }
+    for (const m of report.manual) {
+        process.stdout.write(`  [MANUAL] ${m.ruleId}  ${m.resource}  (${m.file}) — ${m.reason}\n`);
+        if (m.snippet)
+            process.stdout.write(`           ${m.snippet}\n`);
+    }
+    if (dryRun)
+        process.stdout.write("\nDry run — no files were modified. Re-run without --dry-run to apply.\n");
+    process.stdout.write("\n");
+}
+// Minimum HMAC key length, mirrors POLICY_HMAC_MIN_KEY_BYTES in src/gate/policy.ts.
+const POLICY_HMAC_MIN_KEY_BYTES = 32;
+function runSignPolicy() {
+    const key = process.env["SECURITY_POLICY_HMAC_KEY"];
+    if (!key || Buffer.byteLength(key, "utf-8") < POLICY_HMAC_MIN_KEY_BYTES) {
+        process.stderr.write(`Error: SECURITY_POLICY_HMAC_KEY must be set and at least ${POLICY_HMAC_MIN_KEY_BYTES} bytes.\n` +
+            "Generate one with: openssl rand -hex 32\n");
+        process.exit(1);
+    }
+    const policyPath = process.env["SECURITY_GATE_POLICY"] || ".mcp/policies/security-policy.json";
+    if (!existsSync(policyPath)) {
+        process.stderr.write(`Error: policy file not found at "${policyPath}".\n` +
+            "Create one first (cp node_modules/security-mcp/defaults/security-policy.json .mcp/policies/), " +
+            "or set SECURITY_GATE_POLICY to its path.\n");
+        process.exit(1);
+    }
+    const raw = readFileSync(policyPath, "utf-8");
+    const signature = signPolicyFile(raw, key);
+    // 0o600 — keep the sidecar non-world-readable, consistent with data-at-rest hardening.
+    writeFileSync(`${policyPath}.hmac`, signature + "\n", { mode: 0o600 });
+    process.stdout.write(`\nsecurity-mcp sign-policy v${VERSION}\n`);
+    process.stdout.write("=".repeat(40) + "\n\n");
+    process.stdout.write(`  [SIGNED] ${policyPath}\n`);
+    process.stdout.write(`  [WROTE]  ${policyPath}.hmac\n\n`);
+    process.stdout.write("Commit both files so CI can verify policy integrity at gate startup.\n\n");
+}
 async function main() {
     const args = process.argv.slice(2);
     const useGlobalBinary = args.includes("--use-global-binary");
@@ -191,7 +248,8 @@ async function main() {
         process.exit(0);
     }
     const command = args[0] ?? "serve";
-    if (command === "serve") {
+    if (command === "serve" || command === "ci:pr-gate") {
+        // Non-blocking: keep stdout reserved for protocol/JSON output.
         void notifyIfUpdateAvailable(VERSION);
     }
     else {
@@ -245,6 +303,19 @@ async function main() {
             runDoctor();
             break;
         }
+        case "autoharden": {
+            await runAutoHarden(args.includes("--dry-run"));
+            break;
+        }
+        case "ci:pr-gate": {
+            // Reads SECURITY_GATE_* env vars; exits non-zero when the gate fails.
+            await runGateFromEnv();
+            break;
+        }
+        case "sign-policy": {
+            runSignPolicy();
+            break;
+        }
         default: {
             process.stderr.write(`Unknown command: ${command}\nRun with --help for usage.\n`);
             process.exit(1);

package/dist/cli/install.js

@@ -6,7 +6,6 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { homedir, platform } from "node:os";
-import * as https from "node:https";
 import { fileURLToPath } from "node:url";
 import { runOnboarding, installSecurityTools, commandExists, SECURITY_TOOLS } from "./onboarding.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -172,60 +171,10 @@ function installSkill(dryRun) {
  * Mirrors the same pattern used for security tool binary downloads in onboarding.ts.
  */
 // CWE-22: only alphanumeric, hyphens, and dots allowed in skill names
-const SAFE_SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
-// CWE-918: allowlist for skill download hosts — no user-controlled URLs reach the network
-const ALLOWED_SKILL_HOSTS = new Set(["raw.githubusercontent.com", "github.com"]);
-export async function downloadSkill(skillName, url, dryRun = false) {
-    if (!SAFE_SKILL_NAME_RE.test(skillName)) {
-        process.stdout.write(`  [error] invalid skill name "${skillName}" — skipping download\n`);
-        return;
-    }
-    try {
-        const { hostname } = new URL(url);
-        if (!ALLOWED_SKILL_HOSTS.has(hostname)) {
-            process.stdout.write(`  [error] blocked skill download from unauthorized host "${hostname}"\n`);
-            return;
-        }
-    }
-    catch {
-        process.stdout.write(`  [error] invalid skill URL "${url}" — skipping download\n`);
-        return;
-    }
-    const skillDest = resolveHome(`~/.claude/skills/${skillName}/SKILL.md`);
-    if (dryRun) {
-        process.stdout.write(`  [dry-run] would download skill "${skillName}" from ${url} → ${skillDest}\n`);
-        return;
-    }
-    const MAX_SKILL_BYTES = 512 * 1024; // 512 KB — skills are markdown files
-    const content = await new Promise((resolve) => {
-        const req = https.get(url, { headers: { "User-Agent": "security-mcp" } }, (res) => {
-            if ((res.statusCode ?? 500) >= 400) {
-                res.resume();
-                resolve(null);
-                return;
-            }
-            let body = "";
-            res.setEncoding("utf8");
-            res.on("data", (chunk) => {
-                body += chunk;
-                if (Buffer.byteLength(body, "utf8") > MAX_SKILL_BYTES) {
-                    req.destroy();
-                    resolve(null);
-                }
-            });
-            res.on("end", () => resolve(body));
-        });
-        req.on("error", () => resolve(null));
-        req.setTimeout(10000, () => { req.destroy(); resolve(null); });
-    });
-    if (!content) {
-        process.stdout.write(`  [error] failed to download skill "${skillName}" from ${url}\n`);
-        return;
-    }
-    mkdirSync(dirname(skillDest), { recursive: true });
-    writeFileSync(skillDest, content, "utf-8");
-    process.stdout.write(`  installed skill: ${skillDest}\n`);
-}
+// REMOVED downloadSkill(): an unused, integrity-free network skill installer
+// (no sha256, no content sanitization) that, if ever wired up, would bypass every
+// protection in orchestration.ensureSkill. Skills are bundled in the package and
+// resolved locally by ensureSkill; there is no need for an unauthenticated fetcher.
 /**
  * Eagerly install the orchestrator skill (bundled in the package) plus record
  * its version so orchestration.ensure_skill can detect future updates.

package/dist/cli/onboarding.js

@@ -340,11 +340,21 @@ async function installFromGitHub(tool, os) {
             print(`     Integrity verified (SHA-256 matched).`);
         }
         else {
-            print(`     Warning: checksum file found but no entry for ${fileName} — proceeding without verification.`);
+            print(`     ABORT: checksum file found but no entry for ${fileName} — refusing to install an unverified binary (CWE-494).`);
+            try {
+                unlinkSync(tmpFile);
+            }
+            catch { /* ignore cleanup failure */ }
+            return false;
         }
     }
     else {
-        print(`     Warning: no checksum file in release assets — cannot verify binary integrity.`);
+        print(`     ABORT: no checksum file in release assets — refusing to install an unverified binary (CWE-494).`);
+        try {
+            unlinkSync(tmpFile);
+        }
+        catch { /* ignore cleanup failure */ }
+        return false;
     }
     const destDir = "/usr/local/bin";
     if (tool.tarball) {
@@ -432,12 +442,10 @@ async function tryDnf(tool) {
     print(`     sudo ${mgr} install -y trivy`);
     return run("sudo", [mgr, "install", "-y", "trivy"]);
 }
-async function tryInstallScript(tool) {
-    if (!tool.installScript || !commandExists("curl") || !commandExists("sh"))
-        return false;
-    print(`     Running official install script for ${tool.displayName}...`);
-    return run("bash", ["-c", tool.installScript]);
-}
+// REMOVED (CWE-78/CWE-494): the `curl … | sudo sh` install-script strategy piped an
+// unpinned, live-fetched script into root with no checksum — a compromise of the upstream
+// repo or a MITM yielded root RCE on `security-mcp install`. Tools are now installed only
+// via OS package managers or the checksum-verified GitHub-release path (installFromGitHub).
 async function tryWinget(tool) {
     if (!tool.winget || !commandExists("winget"))
         return false;
@@ -461,10 +469,10 @@ async function installSingleTool(tool, os) {
     print(`\n  Installing ${tool.displayName}...`);
     const strategies = [];
     if (os === "macos") {
-        strategies.push(() => tryBrew(tool), () => tryPip(tool), () => tryGoInstall(tool), () => tryInstallScript(tool), () => installFromGitHub(tool, os));
+        strategies.push(() => tryBrew(tool), () => tryPip(tool), () => tryGoInstall(tool), () => installFromGitHub(tool, os));
     }
     else if (os === "linux") {
-        strategies.push(() => tryApt(tool), () => tryDnf(tool), () => tryPip(tool), () => tryGoInstall(tool), () => tryInstallScript(tool), () => installFromGitHub(tool, os));
+        strategies.push(() => tryApt(tool), () => tryDnf(tool), () => tryPip(tool), () => tryGoInstall(tool), () => installFromGitHub(tool, os));
     }
     else {
         // Windows