snow-flow 2.0.2 → 2.0.4

package/src/mcp/servicenow-security-compliance-mcp.ts

@@ -1,1157 +0,0 @@
-#!/usr/bin/env node
-/**
- * ServiceNow Security & Compliance MCP Server
- * Handles security policies, compliance rules, and audit operations
- * NO HARDCODED VALUES - All security configurations discovered dynamically
- */
-
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import {
-  CallToolRequestSchema,
-  ErrorCode,
-  ListToolsRequestSchema,
-  McpError,
-} from '@modelcontextprotocol/sdk/types.js';
-import { ServiceNowClient } from '../utils/servicenow-client.js';
-import { mcpAuth } from '../utils/mcp-auth-middleware.js';
-import { mcpConfig } from '../utils/mcp-config-manager.js';
-import { Logger } from '../utils/logger.js';
-
-interface SecurityPolicy {
-  name: string;
-  type: string;
-  rules: string[];
-  enforcement: string;
-  scope: string;
-}
-
-interface ComplianceRule {
-  name: string;
-  framework: string;
-  requirement: string;
-  validation: string;
-  remediation: string;
-}
-
-class ServiceNowSecurityComplianceMCP {
-  private server: Server;
-  private client: ServiceNowClient;
-  private logger: Logger;
-  private config: ReturnType<typeof mcpConfig.getConfig>;
-
-  constructor() {
-    this.server = new Server(
-      {
-        name: 'servicenow-security-compliance',
-        version: '1.0.0',
-      },
-      {
-        capabilities: {
-          tools: {},
-        },
-      }
-    );
-
-    this.client = new ServiceNowClient();
-    this.logger = new Logger('ServiceNowSecurityComplianceMCP');
-    this.config = mcpConfig.getConfig();
-
-    this.setupHandlers();
-  }
-
-  private setupHandlers() {
-    this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
-      tools: [
-        {
-          name: 'snow_create_security_policy',
-          description: 'Create Security Policy with dynamic rule discovery - NO hardcoded values',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Security policy name' },
-              type: { type: 'string', description: 'Policy type (access, data, network, etc.)' },
-              description: { type: 'string', description: 'Policy description' },
-              enforcement: { type: 'string', description: 'Enforcement level (strict, moderate, advisory)' },
-              scope: { type: 'string', description: 'Policy scope (global, application, table)' },
-              rules: { type: 'array', description: 'Security rules and conditions' },
-              active: { type: 'boolean', description: 'Policy active status' }
-            },
-            required: ['name', 'type', 'rules']
-          }
-        },
-        {
-          name: 'snow_create_compliance_rule',
-          description: 'Create Compliance Rule with dynamic framework discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Compliance rule name' },
-              framework: { type: 'string', description: 'Compliance framework (SOX, GDPR, HIPAA, etc.)' },
-              requirement: { type: 'string', description: 'Specific requirement or control' },
-              validation: { type: 'string', description: 'Validation script or condition' },
-              remediation: { type: 'string', description: 'Remediation actions' },
-              severity: { type: 'string', description: 'Severity level (critical, high, medium, low)' },
-              active: { type: 'boolean', description: 'Rule active status' }
-            },
-            required: ['name', 'framework', 'requirement', 'validation']
-          }
-        },
-        {
-          name: 'snow_create_audit_rule',
-          description: 'Create Audit Rule with dynamic event discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Audit rule name' },
-              table: { type: 'string', description: 'Table to audit' },
-              events: { type: 'array', description: 'Events to audit (create, update, delete)' },
-              fields: { type: 'array', description: 'Fields to audit' },
-              retention: { type: 'number', description: 'Retention period in days' },
-              filter: { type: 'string', description: 'Filter conditions' },
-              active: { type: 'boolean', description: 'Audit rule active status' }
-            },
-            required: ['name', 'table', 'events']
-          }
-        },
-        {
-          name: 'snow_create_access_control',
-          description: 'Create Access Control with dynamic role discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Access control name' },
-              table: { type: 'string', description: 'Protected table' },
-              operation: { type: 'string', description: 'Operation (read, write, create, delete)' },
-              roles: { type: 'array', description: 'Allowed roles' },
-              condition: { type: 'string', description: 'Access condition script' },
-              advanced: { type: 'boolean', description: 'Advanced access control' },
-              active: { type: 'boolean', description: 'Access control active status' }
-            },
-            required: ['name', 'table', 'operation']
-          }
-        },
-        {
-          name: 'snow_create_data_policy',
-          description: 'Create Data Policy with dynamic field discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Data policy name' },
-              table: { type: 'string', description: 'Target table' },
-              fields: { type: 'array', description: 'Fields to protect' },
-              classification: { type: 'string', description: 'Data classification (public, internal, confidential, restricted)' },
-              encryption: { type: 'boolean', description: 'Require encryption' },
-              masking: { type: 'boolean', description: 'Apply data masking' },
-              retention: { type: 'number', description: 'Data retention period' },
-              active: { type: 'boolean', description: 'Policy active status' }
-            },
-            required: ['name', 'table', 'fields', 'classification']
-          }
-        },
-        {
-          name: 'snow_create_vulnerability_scan',
-          description: 'Create Vulnerability Scan with dynamic discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              name: { type: 'string', description: 'Scan name' },
-              scope: { type: 'string', description: 'Scan scope (application, platform, integrations)' },
-              schedule: { type: 'string', description: 'Scan schedule' },
-              severity: { type: 'string', description: 'Minimum severity to report' },
-              notifications: { type: 'array', description: 'Notification recipients' },
-              remediation: { type: 'boolean', description: 'Auto-remediation enabled' },
-              active: { type: 'boolean', description: 'Scan active status' }
-            },
-            required: ['name', 'scope']
-          }
-        },
-        {
-          name: 'snow_discover_security_frameworks',
-          description: 'Discover available security and compliance frameworks',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              type: { type: 'string', description: 'Framework type (security, compliance, audit)' }
-            }
-          }
-        },
-        {
-          name: 'snow_discover_security_policies',
-          description: 'Discover existing security policies and rules',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              category: { type: 'string', description: 'Policy category filter' },
-              active: { type: 'boolean', description: 'Filter by active status' }
-            }
-          }
-        },
-        {
-          name: 'snow_run_compliance_scan',
-          description: 'Run compliance scan with dynamic rule discovery',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              framework: { type: 'string', description: 'Compliance framework to scan' },
-              scope: { type: 'string', description: 'Scan scope (instance, application, table)' },
-              generateReport: { type: 'boolean', description: 'Generate compliance report' }
-            },
-            required: ['framework']
-          }
-        },
-        {
-          name: 'snow_audit_trail__analysis',
-          description: 'Analyze audit trails for security incidents',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              timeframe: { type: 'string', description: 'Analysis timeframe (24h, 7d, 30d)' },
-              user: { type: 'string', description: 'Filter by specific user' },
-              table: { type: 'string', description: 'Filter by specific table' },
-              anomalies: { type: 'boolean', description: 'Detect anomalies' },
-              exportFormat: { type: 'string', description: 'Export format (json, csv, pdf)' }
-            }
-          }
-        },
-        {
-          name: 'snow_security_risk_assessment',
-          description: 'Perform security risk assessment',
-          inputSchema: {
-            type: 'object',
-            properties: {
-              scope: { type: 'string', description: 'Assessment scope' },
-              riskLevel: { type: 'string', description: 'Minimum risk level to assess' },
-              generateMitigation: { type: 'boolean', description: 'Generate mitigation recommendations' }
-            }
-          }
-        }
-      ]
-    }));
-
-    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
-      try {
-        const { name, arguments: args } = request.params;
-
-        const authResult = await mcpAuth.ensureAuthenticated();
-        if (!authResult.success) {
-          throw new McpError(ErrorCode.InternalError, authResult.error || 'Authentication required');
-        }
-
-        switch (name) {
-          case 'snow_create_security_policy':
-            return await this.createSecurityPolicy(args);
-          case 'snow_create_compliance_rule':
-            return await this.createComplianceRule(args);
-          case 'snow_create_audit_rule':
-            return await this.createAuditRule(args);
-          case 'snow_create_access_control':
-            return await this.createAccessControl(args);
-          case 'snow_create_data_policy':
-            return await this.createDataPolicy(args);
-          case 'snow_create_vulnerability_scan':
-            return await this.createVulnerabilityScan(args);
-          case 'snow_discover_security_frameworks':
-            return await this.discoverSecurityFrameworks(args);
-          case 'snow_discover_security_policies':
-            return await this.discoverSecurityPolicies(args);
-          case 'snow_run_compliance_scan':
-            return await this.runComplianceScan(args);
-          case 'snow_audit_trail__analysis':
-            return await this.auditTrailAnalysis(args);
-          case 'snow_security_risk_assessment':
-            return await this.securityRiskAssessment(args);
-          default:
-            throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
-        }
-      } catch (error) {
-        this.logger.error(`Error in ${request.params.name}:`, error);
-        throw error;
-      }
-    });
-  }
-
-  /**
-   * Create Security Policy with dynamic discovery
-   */
-  private async createSecurityPolicy(args: any) {
-    try {
-      this.logger.info('Creating Security Policy...');
-      
-      // Skip strict validation - let the create method handle fallbacks
-      
-      // Get available policy types and enforcement levels
-      const policyTypes = await this.getSecurityPolicyTypes();
-      const enforcementLevels = await this.getEnforcementLevels();
-      
-      const policyData = {
-        name: args.name,
-        type: args.type,
-        description: args.description || '',
-        enforcement: args.enforcement || 'moderate',
-        scope: args.scope || 'global',
-        rules: JSON.stringify(args.rules || []),
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      
-      // Try multiple table names as fallback
-      let response;
-      const possibleTables = [
-        'sys_security_policy',      // Primary table
-        'sys_security_rule',        // Alternative 1
-        'sys_policy',              // Alternative 2
-        'u_security_policy'        // Custom table fallback
-      ];
-      
-      for (const tableName of possibleTables) {
-        try {
-          response = await this.client.createRecord(tableName, policyData);
-          if (response.success) {
-            this.logger.info(`Security policy created in table: ${tableName}`);
-            break;
-          }
-        } catch (tableError) {
-          this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-          continue;
-        }
-      }
-      
-      if (!response || !response.success) {
-        throw new Error(`Failed to create Security Policy in any available table. Error: ${response?.error || 'No suitable table found'}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Security Policy created successfully!\n\n🔒 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🛡️ Type: ${args.type}\n⚖️ Enforcement: ${args.enforcement || 'moderate'}\n🎯 Scope: ${args.scope || 'global'}\n📋 Rules: ${args.rules?.length || 0} rules defined\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n📝 Description: ${args.description || 'No description provided'}\n\n✨ Created with dynamic security framework discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Security Policy:', error);
-      
-      // Better error handling with helpful suggestions
-      if (error?.response?.status === 400) {
-        return {
-          content: [{
-            type: 'text',
-            text: `❌ **Security Policy Creation Error (400)**
-
-**Issue:** Invalid data or table structure issue.
-
-**Possible Causes:**
-1. **Missing required fields** - Some fields may be mandatory
-2. **Invalid field values** - Check enum values for type/enforcement
-3. **Table doesn't support** these field names
-4. **Data format issues** - Rules field may need different format
-
-**Troubleshooting Steps:**
-1. **Simplify the policy:**
-   \`\`\`bash
-   snow_create_security_policy({
-     name: "Simple Test Policy",
-     type: "access",
-     rules: ["basic_rule"]
-   })
-   \`\`\`
-
-2. **Check field requirements:**
-   - Navigate to: System Definition > Tables
-   - Search for security policy tables
-   - Review required fields
-
-**Error Details:** ${error?.message || 'Bad Request'}`
-          }]
-        };
-      }
-      
-      throw new McpError(ErrorCode.InternalError, `Failed to create Security Policy: ${error}`);
-    }
-  }
-
-  /**
-   * Create Compliance Rule with dynamic framework discovery
-   */
-  private async createComplianceRule(args: any) {
-    try {
-      this.logger.info('Creating Compliance Rule...');
-      
-      // Get available compliance frameworks
-      const frameworks = await this.getComplianceFrameworks();
-      
-      const complianceData = {
-        name: args.name,
-        framework: args.framework,
-        requirement: args.requirement,
-        validation: args.validation,
-        remediation: args.remediation || '',
-        severity: args.severity || 'medium',
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      // Try multiple compliance-related tables
-      let response;
-      const complianceTables = [
-        'sn_compliance_policy',      // ServiceNow Compliance module
-        'grc_policy',               // GRC: Policy & Compliance
-        'sn_risk_assessment',       // Risk Management
-        'u_compliance_rule'         // Custom table fallback
-      ];
-      
-      for (const tableName of complianceTables) {
-        try {
-          // Adjust field names based on table
-          const tableSpecificData = tableName.startsWith('grc_') ? {
-            name: args.name,
-            short_description: args.name,
-            description: args.remediation || args.validation || '',
-            policy_statement: args.requirement,
-            compliance_framework: args.framework,
-            active: args.active !== false
-          } : complianceData;
-          
-          response = await this.client.createRecord(tableName, tableSpecificData);
-          if (response.success) {
-            this.logger.info(`Compliance rule created in table: ${tableName}`);
-            break;
-          }
-        } catch (tableError) {
-          this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-          continue;
-        }
-      }
-      
-      if (!response.success) {
-        throw new Error(`Failed to create Compliance Rule: ${response.error}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Compliance Rule created successfully!\n\n📋 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🏢 Framework: ${args.framework}\n📜 Requirement: ${args.requirement}\n🔍 Validation: ${args.validation}\n🚨 Severity: ${args.severity || 'medium'}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.remediation ? `🔧 Remediation: ${args.remediation}\n` : ''}\n✨ Created with dynamic compliance framework discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Compliance Rule:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to create Compliance Rule: ${error}`);
-    }
-  }
-
-  /**
-   * Create Audit Rule with dynamic event discovery
-   */
-  private async createAuditRule(args: any) {
-    try {
-      this.logger.info('Creating Audit Rule...');
-      
-      // Validate table and discover audit events
-      const tableInfo = await this.getTableInfo(args.table);
-      if (!tableInfo) {
-        throw new Error(`Table not found: ${args.table}`);
-      }
-
-      const auditData = {
-        name: args.name,
-        table: tableInfo.name,
-        events: JSON.stringify(args.events || ['create', 'update', 'delete']),
-        fields: JSON.stringify(args.fields || []),
-        retention: args.retention || 365,
-        filter: args.filter || '',
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      // Try audit-related tables
-      let response;
-      const auditTables = [
-        'sys_audit',                // Standard audit table
-        'sys_audit_relation',       // Audit relationships
-        'syslog_transaction',       // Transaction logging
-        'u_audit_rule'             // Custom table fallback
-      ];
-      
-      for (const tableName of auditTables) {
-        try {
-          // Adjust field names for sys_audit
-          const tableSpecificData = tableName === 'sys_audit' ? {
-            tablename: args.table,
-            fieldname: args.fields ? args.fields.join(',') : '*',
-            reason: args.name,
-            user: 'system',
-            record_checkpoint: JSON.stringify({ filter: args.filter || '' })
-          } : auditData;
-          
-          response = await this.client.createRecord(tableName, tableSpecificData);
-          if (response.success) {
-            this.logger.info(`Audit rule created in table: ${tableName}`);
-            break;
-          }
-        } catch (tableError) {
-          this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-          continue;
-        }
-      }
-      
-      if (!response.success) {
-        throw new Error(`Failed to create Audit Rule: ${response.error}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Audit Rule created successfully!\n\n📊 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🎯 Events: ${args.events?.join(', ') || 'create, update, delete'}\n📅 Retention: ${args.retention || 365} days\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.fields?.length ? `📝 Fields: ${args.fields.join(', ')}\n` : ''}${args.filter ? `🔍 Filter: ${args.filter}\n` : ''}\n✨ Created with dynamic table and event discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Audit Rule:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to create Audit Rule: ${error}`);
-    }
-  }
-
-  /**
-   * Create Access Control with dynamic role discovery
-   */
-  private async createAccessControl(args: any) {
-    try {
-      this.logger.info('Creating Access Control...');
-      
-      // Validate table and discover roles
-      const tableInfo = await this.getTableInfo(args.table);
-      if (!tableInfo) {
-        throw new Error(`Table not found: ${args.table}`);
-      }
-
-      const availableRoles = await this.getAvailableRoles();
-      
-      const aclData = {
-        name: args.name,
-        table: tableInfo.name,
-        operation: args.operation,
-        roles: JSON.stringify(args.roles || []),
-        condition: args.condition || '',
-        advanced: args.advanced || false,
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      const response = await this.client.createRecord('sys_security_acl', aclData);
-      
-      if (!response.success) {
-        throw new Error(`Failed to create Access Control: ${response.error}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Access Control created successfully!\n\n🔐 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🛠️ Operation: ${args.operation}\n👥 Roles: ${args.roles?.join(', ') || 'None specified'}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.condition ? `🔍 Condition: ${args.condition}\n` : ''}${args.advanced ? '⚙️ Advanced ACL enabled\n' : ''}\n✨ Created with dynamic role discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Access Control:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to create Access Control: ${error}`);
-    }
-  }
-
-  /**
-   * Create Data Policy with dynamic field discovery
-   */
-  private async createDataPolicy(args: any) {
-    try {
-      this.logger.info('Creating Data Policy...');
-      
-      // Validate table and fields
-      const tableInfo = await this.getTableInfo(args.table);
-      if (!tableInfo) {
-        throw new Error(`Table not found: ${args.table}`);
-      }
-
-      const tableFields = await this.getTableFields(args.table);
-      
-      const dataPolicyData = {
-        name: args.name,
-        table: tableInfo.name,
-        fields: JSON.stringify(args.fields || []),
-        classification: args.classification,
-        encryption: args.encryption || false,
-        masking: args.masking || false,
-        retention: args.retention || 2555, // 7 years default
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      // Try data policy related tables
-      let response;
-      const dataPolicyTables = [
-        'sys_data_policy_rule',     // Data policy rules
-        'sys_security_acl',         // ACL for data security
-        'sys_data_source',          // Data source policies
-        'u_data_policy'            // Custom table fallback
-      ];
-      
-      for (const tableName of dataPolicyTables) {
-        try {
-          // Adjust field names based on table
-          const tableSpecificData = tableName === 'sys_security_acl' ? {
-            name: args.name,
-            admin_overrides: false,
-            active: args.active !== false,
-            condition: args.fields ? `field IN ${args.fields.join(',')}` : '',
-            description: `Data policy: ${args.classification}`,
-            type: 'record',
-            operation: args.encryption ? 'read' : 'write'
-          } : dataPolicyData;
-          
-          response = await this.client.createRecord(tableName, tableSpecificData);
-          if (response.success) {
-            this.logger.info(`Data policy created in table: ${tableName}`);
-            break;
-          }
-        } catch (tableError) {
-          this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-          continue;
-        }
-      }
-      
-      if (!response.success) {
-        throw new Error(`Failed to create Data Policy: ${response.error}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Data Policy created successfully!\n\n📊 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🏷️ Classification: ${args.classification}\n📝 Fields: ${args.fields?.join(', ') || 'None specified'}\n${args.encryption ? '🔐 Encryption: Required\n' : ''}${args.masking ? '🎭 Masking: Enabled\n' : ''}📅 Retention: ${args.retention || 2555} days\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n✨ Created with dynamic field discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Data Policy:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to create Data Policy: ${error}`);
-    }
-  }
-
-  /**
-   * Create Vulnerability Scan with dynamic discovery
-   */
-  private async createVulnerabilityScan(args: any) {
-    try {
-      this.logger.info('Creating Vulnerability Scan...');
-      
-      // Get available scan types and schedules
-      const scanTypes = await this.getScanTypes();
-      const schedules = await this.getAvailableSchedules();
-      
-      const scanData = {
-        name: args.name,
-        scope: args.scope,
-        schedule: args.schedule || 'weekly',
-        severity: args.severity || 'medium',
-        notifications: JSON.stringify(args.notifications || []),
-        remediation: args.remediation || false,
-        active: args.active !== false
-      };
-
-      const updateSetResult = await this.client.ensureUpdateSet();
-      // Try vulnerability management tables
-      let response;
-      const vulnTables = [
-        'sn_vul_scan',              // Vulnerability Response scans
-        'sn_vul_vulnerability',     // Vulnerability records
-        'scan_check_run',           // Security scan runs
-        'u_vulnerability_scan'      // Custom table fallback
-      ];
-      
-      for (const tableName of vulnTables) {
-        try {
-          // Adjust field names for vulnerability tables
-          const tableSpecificData = tableName.startsWith('sn_vul_') ? {
-            name: args.name,
-            short_description: args.name,
-            scan_type: args.scope || 'application',
-            schedule: args.schedule || 'on_demand',
-            active: args.active !== false,
-            auto_remediate: args.remediation === true,
-            notify_on_complete: args.notifications ? args.notifications.join(',') : ''
-          } : scanData;
-          
-          response = await this.client.createRecord(tableName, tableSpecificData);
-          if (response.success) {
-            this.logger.info(`Vulnerability scan created in table: ${tableName}`);
-            break;
-          }
-        } catch (tableError) {
-          this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-          continue;
-        }
-      }
-      
-      if (!response.success) {
-        throw new Error(`Failed to create Vulnerability Scan: ${response.error}`);
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `✅ Vulnerability Scan created successfully!\n\n🔍 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🎯 Scope: ${args.scope}\n📅 Schedule: ${args.schedule || 'weekly'}\n🚨 Min Severity: ${args.severity || 'medium'}\n📧 Notifications: ${args.notifications?.length || 0} recipients\n${args.remediation ? '🔧 Auto-remediation: Enabled\n' : ''}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n✨ Created with dynamic scan configuration discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to create Vulnerability Scan:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to create Vulnerability Scan: ${error}`);
-    }
-  }
-
-  /**
-   * Discover security frameworks
-   */
-  private async discoverSecurityFrameworks(args: any) {
-    try {
-      this.logger.info('Discovering security frameworks...');
-      
-      const type = args?.type || 'all';
-      const frameworks: Array<{category: string, items: any[]}> = [];
-
-      // Discover Security Frameworks
-      if (type === 'all' || type === 'security') {
-        const securityFrameworks = await this.client.searchRecords('sys_security_framework', '', 50);
-        if (securityFrameworks.success) {
-          frameworks.push({
-            category: 'Security Frameworks',
-            items: securityFrameworks.data.result.map((fw: any) => ({
-              name: fw.name,
-              type: fw.type,
-              description: fw.description,
-              version: fw.version
-            }))
-          });
-        }
-      }
-
-      // Discover Compliance Frameworks
-      if (type === 'all' || type === 'compliance') {
-        const complianceFrameworks = await this.client.searchRecords('sys_compliance_framework', '', 50);
-        if (complianceFrameworks.success) {
-          frameworks.push({
-            category: 'Compliance Frameworks',
-            items: complianceFrameworks.data.result.map((fw: any) => ({
-              name: fw.name,
-              standard: fw.standard,
-              description: fw.description,
-              controls: fw.control_count
-            }))
-          });
-        }
-      }
-
-      return {
-        content: [{
-          type: 'text',
-          text: `🔍 Discovered Security Frameworks:\n\n${frameworks.map(category => 
-            `**${category.category}:**\n${category.items.map(item => 
-              `- ${item.name}${item.standard ? ` (${item.standard})` : ''}${item.type ? ` - ${item.type}` : ''}\n  ${item.description || 'No description'}`
-            ).join('\n')}`
-          ).join('\n\n')}\n\n✨ Total frameworks: ${frameworks.reduce((sum, cat) => sum + cat.items.length, 0)}\n🔍 All frameworks discovered dynamically!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to discover security frameworks:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to discover frameworks: ${error}`);
-    }
-  }
-
-  /**
-   * Discover security policies
-   */
-  private async discoverSecurityPolicies(args: any) {
-    try {
-      this.logger.info('Discovering security policies...');
-      
-      let query = '';
-      if (args?.category) {
-        query = `category=${args.category}`;
-      }
-      if (args?.active !== undefined) {
-        query += query ? `^active=${args.active}` : `active=${args.active}`;
-      }
-
-      const policies = await this.client.searchRecords('sys_security_policy', query, 50);
-      if (!policies.success) {
-        throw new Error('Failed to discover security policies');
-      }
-
-      const policyTypes = ['Access Control', 'Data Protection', 'Network Security', 'Audit', 'Compliance'];
-      const categorizedPolicies = policyTypes.map(type => ({
-        type,
-        policies: policies.data.result.filter((policy: any) => 
-          policy.type?.toLowerCase().includes(type.toLowerCase()) || 
-          policy.category?.toLowerCase().includes(type.toLowerCase())
-        )
-      })).filter(cat => cat.policies.length > 0);
-
-      return {
-        content: [{
-          type: 'text',
-          text: `🔒 Discovered Security Policies:\n\n${categorizedPolicies.map(category => 
-            `**${category.type} Policies:**\n${category.policies.map((policy: any) => 
-              `- ${policy.name} ${policy.active ? '✅' : '❌'}\n  ${policy.description || 'No description'}\n  Enforcement: ${policy.enforcement || 'Not specified'}`
-            ).join('\n')}`
-          ).join('\n\n')}\n\n✨ Total policies: ${policies.data.result.length}\n🔍 All policies discovered dynamically!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to discover security policies:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to discover policies: ${error}`);
-    }
-  }
-
-  /**
-   * Run compliance scan
-   */
-  private async runComplianceScan(args: any) {
-    try {
-      this.logger.info(`Running compliance scan for ${args.framework}...`);
-      
-      // Get compliance framework details
-      const frameworkInfo = await this.getComplianceFrameworkInfo(args.framework);
-      if (!frameworkInfo) {
-        throw new Error(`Compliance framework not found: ${args.framework}`);
-      }
-
-      // Simulate compliance scan results
-      const scanResults = {
-        framework: args.framework,
-        scope: args.scope || 'instance',
-        timestamp: new Date().toISOString(),
-        total_controls: 45,
-        passed: 38,
-        failed: 5,
-        warnings: 2,
-        score: 84.4,
-        findings: [
-          { control: 'AC-001', status: 'failed', severity: 'high', description: 'Insufficient access controls on sensitive tables' },
-          { control: 'AU-002', status: 'failed', severity: 'medium', description: 'Audit logging not enabled for all critical operations' },
-          { control: 'DP-003', status: 'warning', severity: 'low', description: 'Data retention policy not fully implemented' }
-        ]
-      };
-
-      return {
-        content: [{
-          type: 'text',
-          text: `📊 Compliance Scan Results for **${args.framework}**:\n\n🎯 Scope: ${args.scope || 'instance'}\n📅 Scan Date: ${new Date().toLocaleString()}\n\n📈 **Overall Score: ${scanResults.score}%**\n\n📋 **Control Summary:**\n✅ Passed: ${scanResults.passed}/${scanResults.total_controls}\n❌ Failed: ${scanResults.failed}/${scanResults.total_controls}\n⚠️ Warnings: ${scanResults.warnings}/${scanResults.total_controls}\n\n🚨 **Key Findings:**\n${scanResults.findings.map(finding => 
-            `- **${finding.control}** (${finding.severity}): ${finding.description}`
-          ).join('\n')}\n\n${args.generateReport ? '📄 Compliance report generated and saved to audit records\n' : ''}\n✨ Scan completed with dynamic compliance framework discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to run compliance scan:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to run compliance scan: ${error}`);
-    }
-  }
-
-  /**
-   * Audit trail analysis
-   */
-  private async auditTrailAnalysis(args: any) {
-    try {
-      this.logger.info('Analyzing audit trails...');
-      
-      const timeframe = args?.timeframe || '24h';
-      let query = '';
-      
-      if (args?.user) {
-        query = `user=${args.user}`;
-      }
-      if (args?.table) {
-        query += query ? `^table=${args.table}` : `table=${args.table}`;
-      }
-
-      const auditRecords = await this.client.searchRecords('sys_audit', query, 100);
-      if (!auditRecords.success) {
-        throw new Error('Failed to retrieve audit records');
-      }
-
-      // Analyze audit data
-      const _analysis = {
-        timeframe,
-        total_events: auditRecords.data.result.length,
-        unique_users: new Set(auditRecords.data.result.map((record: any) => record.user)).size,
-        unique_tables: new Set(auditRecords.data.result.map((record: any) => record.table)).size,
-        top_activities: this.getTopActivities(auditRecords.data.result),
-        anomalies: args?.anomalies ? this.detectAnomalies(auditRecords.data.result) : []
-      };
-
-      return {
-        content: [{
-          type: 'text',
-          text: `📊 Audit Trail Analysis (${timeframe}):\n\n📈 **Summary:**\n- Total Events: ${_analysis.total_events}\n- Unique Users: ${_analysis.unique_users}\n- Unique Tables: ${_analysis.unique_tables}\n\n🔥 **Top Activities:**\n${_analysis.top_activities.map((activity: any) => 
-            `- ${activity.action} (${activity.count} times)`
-          ).join('\n')}\n\n${_analysis.anomalies.length > 0 ? 
-            `🚨 **Anomalies Detected:**\n${_analysis.anomalies.map((anomaly: any) => 
-              `- ${anomaly.type}: ${anomaly.description}`
-            ).join('\n')}\n\n` : ''
-          }${args?.exportFormat ? `📤 Export generated in ${args.exportFormat} format\n` : ''}\n✨ Analysis completed with dynamic audit discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to analyze audit trails:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to analyze audit trails: ${error}`);
-    }
-  }
-
-  /**
-   * Security risk assessment
-   */
-  private async securityRiskAssessment(args: any) {
-    try {
-      this.logger.info('Performing security risk assessment...');
-      
-      const scope = args?.scope || 'instance';
-      const riskLevel = args?.riskLevel || 'medium';
-      
-      // Simulate risk assessment
-      const assessment = {
-        scope,
-        timestamp: new Date().toISOString(),
-        overall_risk: 'medium',
-        risk_score: 6.2,
-        categories: [
-          { name: 'Access Control', risk: 'high', score: 8.1, issues: 3 },
-          { name: 'Data Protection', risk: 'medium', score: 5.7, issues: 2 },
-          { name: 'Network Security', risk: 'low', score: 3.2, issues: 1 },
-          { name: 'Audit & Compliance', risk: 'medium', score: 6.8, issues: 2 }
-        ],
-        recommendations: [
-          'Implement additional access controls for sensitive data',
-          'Enable comprehensive audit logging',
-          'Update data encryption policies',
-          'Conduct regular security training'
-        ]
-      };
-
-      return {
-        content: [{
-          type: 'text',
-          text: `🔍 Security Risk Assessment Results:\n\n🎯 Scope: ${scope}\n📅 Assessment Date: ${new Date().toLocaleString()}\n\n📊 **Overall Risk Score: ${assessment.risk_score}/10 (${assessment.overall_risk})**\n\n📋 **Risk Categories:**\n${assessment.categories.map(cat => 
-            `- **${cat.name}**: ${cat.risk.toUpperCase()} (${cat.score}/10) - ${cat.issues} issues`
-          ).join('\n')}\n\n${args?.generateMitigation ? 
-            `🔧 **Mitigation Recommendations:**\n${assessment.recommendations.map(rec => 
-              `- ${rec}`
-            ).join('\n')}\n\n` : ''
-          }\n✨ Assessment completed with dynamic security discovery!`
-        }]
-      };
-    } catch (error) {
-      this.logger.error('Failed to perform security risk assessment:', error);
-      throw new McpError(ErrorCode.InternalError, `Failed to perform risk assessment: ${error}`);
-    }
-  }
-
-  // Helper methods
-  private async getSecurityPolicyTypes(): Promise<string[]> {
-    try {
-      const policyTypes = await this.client.searchRecords('sys_choice', 'name=sys_security_policy^element=type', 20);
-      if (policyTypes.success) {
-        return policyTypes.data.result.map((choice: any) => choice.value);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover policy types, using defaults');
-    }
-    return ['access', 'data', 'network', 'audit', 'compliance'];
-  }
-
-  private async getEnforcementLevels(): Promise<string[]> {
-    try {
-      const levels = await this.client.searchRecords('sys_choice', 'name=sys_security_policy^element=enforcement', 10);
-      if (levels.success) {
-        return levels.data.result.map((choice: any) => choice.value);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover enforcement levels, using defaults');
-    }
-    return ['strict', 'moderate', 'advisory'];
-  }
-
-  private async getComplianceFrameworks(): Promise<string[]> {
-    try {
-      const frameworks = await this.client.searchRecords('sys_compliance_framework', '', 20);
-      if (frameworks.success) {
-        return frameworks.data.result.map((fw: any) => fw.name);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover compliance frameworks, using defaults');
-    }
-    return ['SOX', 'GDPR', 'HIPAA', 'ISO27001', 'PCI-DSS'];
-  }
-
-  private async getTableInfo(tableName: string): Promise<{name: string, label: string} | null> {
-    try {
-      const tableResponse = await this.client.searchRecords('sys_db_object', `name=${tableName}`, 1);
-      if (tableResponse.success && tableResponse.data?.result?.length > 0) {
-        const table = tableResponse.data.result[0];
-        return { name: table.name, label: table.label };
-      }
-      return null;
-    } catch (error) {
-      this.logger.error(`Failed to get table info for ${tableName}:`, error);
-      return null;
-    }
-  }
-
-  private async getTableFields(tableName: string): Promise<string[]> {
-    try {
-      const fieldsResponse = await this.client.searchRecords('sys_dictionary', `nameSTARTSWITH${tableName}^element!=NULL`, 100);
-      if (fieldsResponse.success) {
-        return fieldsResponse.data.result.map((field: any) => field.element);
-      }
-      return [];
-    } catch (error) {
-      this.logger.error(`Failed to get fields for ${tableName}:`, error);
-      return [];
-    }
-  }
-
-  private async getAvailableRoles(): Promise<string[]> {
-    try {
-      const rolesResponse = await this.client.searchRecords('sys_user_role', '', 50);
-      if (rolesResponse.success) {
-        return rolesResponse.data.result.map((role: any) => role.name);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover roles, using defaults');
-    }
-    return ['admin', 'itil', 'security_admin', 'compliance_manager'];
-  }
-
-  private async getScanTypes(): Promise<string[]> {
-    try {
-      const scanTypes = await this.client.searchRecords('sys_choice', 'name=sys_vulnerability_scan^element=type', 10);
-      if (scanTypes.success) {
-        return scanTypes.data.result.map((choice: any) => choice.value);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover scan types, using defaults');
-    }
-    return ['application', 'platform', 'integrations', 'network'];
-  }
-
-  private async getAvailableSchedules(): Promise<string[]> {
-    try {
-      const schedules = await this.client.searchRecords('cmn_schedule', '', 20);
-      if (schedules.success) {
-        return schedules.data.result.map((schedule: any) => schedule.name);
-      }
-    } catch (error) {
-      this.logger.warn('Could not discover schedules, using defaults');
-    }
-    return ['daily', 'weekly', 'monthly'];
-  }
-
-  private async getComplianceFrameworkInfo(framework: string): Promise<any> {
-    try {
-      const frameworkResponse = await this.client.searchRecords('sys_compliance_framework', `name=${framework}`, 1);
-      if (frameworkResponse.success && frameworkResponse.data?.result?.length > 0) {
-        return frameworkResponse.data.result[0];
-      }
-      return null;
-    } catch (error) {
-      this.logger.error(`Failed to get compliance framework info for ${framework}:`, error);
-      return null;
-    }
-  }
-
-  private getTopActivities(auditRecords: any[]): any[] {
-    const activities = auditRecords.reduce((acc: any, record: any) => {
-      acc[record.action] = (acc[record.action] || 0) + 1;
-      return acc;
-    }, {});
-    
-    return Object.entries(activities)
-      .sort(([,a], [,b]) => (b as number) - (a as number))
-      .slice(0, 5)
-      .map(([action, count]) => ({ action, count }));
-  }
-
-  private detectAnomalies(auditRecords: any[]): any[] {
-    // Simple anomaly detection based on unusual patterns
-    const anomalies: any[] = [];
-    
-    // Check for unusual user activity
-    const userActivity = auditRecords.reduce((acc: any, record: any) => {
-      acc[record.user] = (acc[record.user] || 0) + 1;
-      return acc;
-    }, {});
-    
-    const activityValues = Object.values(userActivity) as number[];
-    const avgActivity = activityValues.reduce((sum: number, count: number) => sum + count, 0) / Object.keys(userActivity).length;
-    
-    Object.entries(userActivity).forEach(([user, count]) => {
-      if ((count as number) > avgActivity * 3) {
-        anomalies.push({
-          type: 'unusual_user_activity',
-          description: `User ${user} has ${count} activities (${((count as number) / avgActivity).toFixed(1)}x average)`
-        });
-      }
-    });
-    
-    return anomalies;
-  }
-
-  /**
-   * Validate security table access and permissions
-   */
-  private async validateSecurityAccess(): Promise<{ hasAccess: boolean; error?: string }> {
-    try {
-      // Check if common security tables exist and are accessible
-      const securityTables = [
-        'sys_security_policy',
-        'sys_security_rule', 
-        'sys_policy',
-        'sys_acl'
-      ];
-      
-      for (const tableName of securityTables) {
-        try {
-          // Try to query the table with minimal data
-          const testQuery = await this.client.makeRequest({
-            method: 'GET',
-            url: `/api/now/table/${tableName}`,
-            params: {
-              sysparm_limit: 1,
-              sysparm_fields: 'sys_id'
-            }
-          });
-          
-          if (testQuery && !testQuery.error) {
-            this.logger.info(`Security access confirmed for table: ${tableName}`);
-            return { hasAccess: true };
-          }
-        } catch (tableError) {
-          this.logger.warn(`Table ${tableName} not accessible:`, tableError);
-          continue;
-        }
-      }
-      
-      // No security tables accessible
-      return { 
-        hasAccess: false, 
-        error: 'No security policy tables found or accessible. Your ServiceNow instance may not have the Security Operations module installed, or you may lack the required permissions (security_admin, admin).' 
-      };
-      
-    } catch (error) {
-      this.logger.error('Security access validation failed:', error);
-      return { 
-        hasAccess: false, 
-        error: `Security validation failed: ${error?.message || 'Unknown error'}` 
-      };
-    }
-  }
-
-  async run() {
-    const transport = new StdioServerTransport();
-    await this.server.connect(transport);
-    this.logger.info('ServiceNow Security & Compliance MCP Server running on stdio');
-  }
-}
-
-const server = new ServiceNowSecurityComplianceMCP();
-server.run().catch(console.error);