snow-flow 8.42.12 → 9.0.1

package/dist/mcp/servicenow-security-compliance-mcp.js

@@ -1,1055 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/**
- * ServiceNow Security & Compliance MCP Server
- * Handles security policies, compliance rules, and audit operations
- * NO HARDCODED VALUES - All security configurations discovered dynamically
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-const index_js_1 = require("@modelcontextprotocol/sdk/server/index.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const servicenow_client_js_1 = require("../utils/servicenow-client.js");
-const mcp_auth_middleware_js_1 = require("../utils/mcp-auth-middleware.js");
-const mcp_config_manager_js_1 = require("../utils/mcp-config-manager.js");
-const mcp_logger_js_1 = require("./shared/mcp-logger.js");
-class ServiceNowSecurityComplianceMCP {
-    constructor() {
-        this.server = new index_js_1.Server({
-            name: 'servicenow-security-compliance',
-            version: '1.0.0',
-        }, {
-            capabilities: {
-                tools: {},
-            },
-        });
-        this.client = new servicenow_client_js_1.ServiceNowClient();
-        this.logger = new mcp_logger_js_1.MCPLogger('ServiceNowSecurityComplianceMCP');
-        this.config = mcp_config_manager_js_1.mcpConfig.getConfig();
-        this.setupHandlers();
-    }
-    setupHandlers() {
-        this.server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-            tools: [
-                {
-                    name: 'snow_create_security_policy',
-                    description: 'Creates security policies for access control and data protection. Configures enforcement levels, scope, and rule sets.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Security policy name' },
-                            type: { type: 'string', description: 'Policy type (access, data, network, etc.)' },
-                            description: { type: 'string', description: 'Policy description' },
-                            enforcement: { type: 'string', description: 'Enforcement level (strict, moderate, advisory)' },
-                            scope: { type: 'string', description: 'Policy scope (global, application, table)' },
-                            rules: { type: 'array', description: 'Security rules and conditions' },
-                            active: { type: 'boolean', description: 'Policy active status' }
-                        },
-                        required: ['name', 'type', 'rules']
-                    }
-                },
-                {
-                    name: 'snow_create_compliance_rule',
-                    description: 'Creates compliance rules for regulatory frameworks (SOX, GDPR, HIPAA). Defines validation, remediation, and severity levels.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Compliance rule name' },
-                            framework: { type: 'string', description: 'Compliance framework (SOX, GDPR, HIPAA, etc.)' },
-                            requirement: { type: 'string', description: 'Specific requirement or control' },
-                            validation: { type: 'string', description: 'Validation script or condition' },
-                            remediation: { type: 'string', description: 'Remediation actions' },
-                            severity: { type: 'string', description: 'Severity level (critical, high, medium, low)' },
-                            active: { type: 'boolean', description: 'Rule active status' }
-                        },
-                        required: ['name', 'framework', 'requirement', 'validation']
-                    }
-                },
-                {
-                    name: 'snow_create_audit_rule',
-                    description: 'Creates audit rules for tracking data changes. Configures monitored events, fields, and retention periods.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Audit rule name' },
-                            table: { type: 'string', description: 'Table to audit' },
-                            events: { type: 'array', description: 'Events to audit (create, update, delete)' },
-                            fields: { type: 'array', description: 'Fields to audit' },
-                            retention: { type: 'number', description: 'Retention period in days' },
-                            filter: { type: 'string', description: 'Filter conditions' },
-                            active: { type: 'boolean', description: 'Audit rule active status' }
-                        },
-                        required: ['name', 'table', 'events']
-                    }
-                },
-                {
-                    name: 'snow_create_access_control',
-                    description: 'Creates access control rules for table and field security. Manages role-based permissions and conditional access.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Access control name' },
-                            table: { type: 'string', description: 'Protected table' },
-                            operation: { type: 'string', description: 'Operation (read, write, create, delete)' },
-                            roles: { type: 'array', description: 'Allowed roles' },
-                            condition: { type: 'string', description: 'Access condition script' },
-                            advanced: { type: 'boolean', description: 'Advanced access control' },
-                            active: { type: 'boolean', description: 'Access control active status' }
-                        },
-                        required: ['name', 'table', 'operation']
-                    }
-                },
-                {
-                    name: 'snow_create_data_policy',
-                    description: 'Creates data classification and protection policies. Configures encryption, masking, and retention requirements.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Data policy name' },
-                            table: { type: 'string', description: 'Target table' },
-                            fields: { type: 'array', description: 'Fields to protect' },
-                            classification: { type: 'string', description: 'Data classification (public, internal, confidential, restricted)' },
-                            encryption: { type: 'boolean', description: 'Require encryption' },
-                            masking: { type: 'boolean', description: 'Apply data masking' },
-                            retention: { type: 'number', description: 'Data retention period' },
-                            active: { type: 'boolean', description: 'Policy active status' }
-                        },
-                        required: ['name', 'table', 'fields', 'classification']
-                    }
-                },
-                {
-                    name: 'snow_create_vulnerability_scan',
-                    description: 'Creates vulnerability scanning configurations. Schedules scans, sets severity thresholds, and enables auto-remediation.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            name: { type: 'string', description: 'Scan name' },
-                            scope: { type: 'string', description: 'Scan scope (application, platform, integrations)' },
-                            schedule: { type: 'string', description: 'Scan schedule' },
-                            severity: { type: 'string', description: 'Minimum severity to report' },
-                            notifications: { type: 'array', description: 'Notification recipients' },
-                            remediation: { type: 'boolean', description: 'Auto-remediation enabled' },
-                            active: { type: 'boolean', description: 'Scan active status' }
-                        },
-                        required: ['name', 'scope']
-                    }
-                },
-                {
-                    name: 'snow_discover_security_frameworks',
-                    description: 'Discovers security and compliance frameworks available in the instance for policy creation and auditing.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            type: { type: 'string', description: 'Framework type (security, compliance, audit)' }
-                        }
-                    }
-                },
-                {
-                    name: 'snow_discover_security_policies',
-                    description: 'Lists existing security policies and rules with filtering by category and active status.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            category: { type: 'string', description: 'Policy category filter' },
-                            active: { type: 'boolean', description: 'Filter by active status' }
-                        }
-                    }
-                },
-                {
-                    name: 'snow_run_compliance_scan',
-                    description: 'Executes compliance scans against selected frameworks. Generates reports and identifies violations.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            framework: { type: 'string', description: 'Compliance framework to scan' },
-                            scope: { type: 'string', description: 'Scan scope (instance, application, table)' },
-                            generateReport: { type: 'boolean', description: 'Generate compliance report' }
-                        },
-                        required: ['framework']
-                    }
-                },
-                {
-                    name: 'snow_audit_trail__analysis',
-                    description: 'Analyzes audit logs for security incidents and anomalies. Supports filtering by time, user, and table.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            timeframe: { type: 'string', description: 'Analysis timeframe (24h, 7d, 30d)' },
-                            user: { type: 'string', description: 'Filter by specific user' },
-                            table: { type: 'string', description: 'Filter by specific table' },
-                            anomalies: { type: 'boolean', description: 'Detect anomalies' },
-                            exportFormat: { type: 'string', description: 'Export format (json, csv, pdf)' }
-                        }
-                    }
-                },
-                {
-                    name: 'snow_security_risk_assessment',
-                    description: 'Performs comprehensive security risk assessments with mitigation recommendations and risk scoring.',
-                    inputSchema: {
-                        type: 'object',
-                        properties: {
-                            scope: { type: 'string', description: 'Assessment scope' },
-                            riskLevel: { type: 'string', description: 'Minimum risk level to assess' },
-                            generateMitigation: { type: 'boolean', description: 'Generate mitigation recommendations' }
-                        }
-                    }
-                }
-            ]
-        }));
-        this.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
-            try {
-                const { name, arguments: args } = request.params;
-                // Start operation with token tracking
-                this.logger.operationStart(name, args);
-                const authResult = await mcp_auth_middleware_js_1.mcpAuth.ensureAuthenticated();
-                if (!authResult.success) {
-                    throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, authResult.error || 'Authentication required');
-                }
-                let result;
-                switch (name) {
-                    case 'snow_create_security_policy':
-                        result = await this.createSecurityPolicy(args);
-                        break;
-                    case 'snow_create_compliance_rule':
-                        result = await this.createComplianceRule(args);
-                        break;
-                    case 'snow_create_audit_rule':
-                        result = await this.createAuditRule(args);
-                        break;
-                    case 'snow_create_access_control':
-                        result = await this.createAccessControl(args);
-                        break;
-                    case 'snow_create_data_policy':
-                        result = await this.createDataPolicy(args);
-                        break;
-                    case 'snow_create_vulnerability_scan':
-                        result = await this.createVulnerabilityScan(args);
-                        break;
-                    case 'snow_discover_security_frameworks':
-                        result = await this.discoverSecurityFrameworks(args);
-                        break;
-                    case 'snow_discover_security_policies':
-                        result = await this.discoverSecurityPolicies(args);
-                        break;
-                    case 'snow_run_compliance_scan':
-                        result = await this.runComplianceScan(args);
-                        break;
-                    case 'snow_audit_trail__analysis':
-                        result = await this.auditTrailAnalysis(args);
-                        break;
-                    case 'snow_security_risk_assessment':
-                        result = await this.securityRiskAssessment(args);
-                        break;
-                    default:
-                        throw new types_js_1.McpError(types_js_1.ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
-                }
-                // Complete operation with token tracking
-                result = this.logger.addTokenUsageToResponse(result);
-                result = this.logger.addTokenUsageToResponse(result);
-                this.logger.operationComplete(name, result);
-                return result;
-            }
-            catch (error) {
-                this.logger.error(`Error in ${request.params.name}:`, error);
-                throw error;
-            }
-        });
-    }
-    /**
-     * Create Security Policy with dynamic discovery
-     */
-    async createSecurityPolicy(args) {
-        try {
-            this.logger.info('Creating Security Policy...');
-            // Skip strict validation - let the create method handle fallbacks
-            // Get available policy types and enforcement levels
-            const policyTypes = await this.getSecurityPolicyTypes();
-            const enforcementLevels = await this.getEnforcementLevels();
-            const policyData = {
-                name: args.name,
-                type: args.type,
-                description: args.description || '',
-                enforcement: args.enforcement || 'moderate',
-                scope: args.scope || 'global',
-                rules: JSON.stringify(args.rules || []),
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            // Try multiple table names as fallback
-            let response;
-            const possibleTables = [
-                'sys_security_policy', // Primary table
-                'sys_security_rule', // Alternative 1
-                'sys_policy', // Alternative 2
-                'u_security_policy' // Custom table fallback
-            ];
-            for (const tableName of possibleTables) {
-                try {
-                    this.logger.trackAPICall('CREATE', tableName, 1);
-                    response = await this.client.createRecord(tableName, policyData);
-                    if (response.success) {
-                        this.logger.info(`Security policy created in table: ${tableName}`);
-                        break;
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-                    continue;
-                }
-            }
-            if (!response || !response.success) {
-                throw new Error(`Failed to create Security Policy in any available table. Error: ${response?.error || 'No suitable table found'}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Security Policy created successfully!\n\n🔒 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🛡️ Type: ${args.type}\n⚖️ Enforcement: ${args.enforcement || 'moderate'}\n🎯 Scope: ${args.scope || 'global'}\n📋 Rules: ${args.rules?.length || 0} rules defined\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n📝 Description: ${args.description || 'No description provided'}\n\n✨ Created with dynamic security framework discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Security Policy:', error);
-            // Better error handling with helpful suggestions
-            if (error?.response?.status === 400) {
-                return {
-                    content: [{
-                            type: 'text',
-                            text: `❌ **Security Policy Creation Error (400)**
-
-**Issue:** Invalid data or table structure issue.
-
-**Possible Causes:**
-1. **Missing required fields** - Some fields may be mandatory
-2. **Invalid field values** - Check enum values for type/enforcement
-3. **Table doesn't support** these field names
-4. **Data format issues** - Rules field may need different format
-
-**Troubleshooting Steps:**
-1. **Simplify the policy:**
-   \`\`\`bash
-   snow_create_security_policy({
-     name: "Simple Test Policy",
-     type: "access",
-     rules: ["basic_rule"]
-   })
-   \`\`\`
-
-2. **Check field requirements:**
-   - Navigate to: System Definition > Tables
-   - Search for security policy tables
-   - Review required fields
-
-**Error Details:** ${error?.message || 'Bad Request'}`
-                        }]
-                };
-            }
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Security Policy: ${error}`);
-        }
-    }
-    /**
-     * Create Compliance Rule with dynamic framework discovery
-     */
-    async createComplianceRule(args) {
-        try {
-            this.logger.info('Creating Compliance Rule...');
-            // Get available compliance frameworks
-            const frameworks = await this.getComplianceFrameworks();
-            const complianceData = {
-                name: args.name,
-                framework: args.framework,
-                requirement: args.requirement,
-                validation: args.validation,
-                remediation: args.remediation || '',
-                severity: args.severity || 'medium',
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            // Try multiple compliance-related tables
-            let response;
-            const complianceTables = [
-                'sn_compliance_policy', // ServiceNow Compliance module
-                'grc_policy', // GRC: Policy & Compliance
-                'sn_risk_assessment', // Risk Management
-                'u_compliance_rule' // Custom table fallback
-            ];
-            for (const tableName of complianceTables) {
-                try {
-                    // Adjust field names based on table
-                    const tableSpecificData = tableName.startsWith('grc_') ? {
-                        name: args.name,
-                        short_description: args.name,
-                        description: args.remediation || args.validation || '',
-                        policy_statement: args.requirement,
-                        compliance_framework: args.framework,
-                        active: args.active !== false
-                    } : complianceData;
-                    response = await this.client.createRecord(tableName, tableSpecificData);
-                    if (response.success) {
-                        this.logger.info(`Compliance rule created in table: ${tableName}`);
-                        break;
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-                    continue;
-                }
-            }
-            if (!response.success) {
-                throw new Error(`Failed to create Compliance Rule: ${response.error}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Compliance Rule created successfully!\n\n📋 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🏢 Framework: ${args.framework}\n📜 Requirement: ${args.requirement}\n🔍 Validation: ${args.validation}\n🚨 Severity: ${args.severity || 'medium'}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.remediation ? `🔧 Remediation: ${args.remediation}\n` : ''}\n✨ Created with dynamic compliance framework discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Compliance Rule:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Compliance Rule: ${error}`);
-        }
-    }
-    /**
-     * Create Audit Rule with dynamic event discovery
-     */
-    async createAuditRule(args) {
-        try {
-            this.logger.info('Creating Audit Rule...');
-            // Validate table and discover audit events
-            const tableInfo = await this.getTableInfo(args.table);
-            if (!tableInfo) {
-                throw new Error(`Table not found: ${args.table}`);
-            }
-            const auditData = {
-                name: args.name,
-                table: tableInfo.name,
-                events: JSON.stringify(args.events || ['create', 'update', 'delete']),
-                fields: JSON.stringify(args.fields || []),
-                retention: args.retention || 365,
-                filter: args.filter || '',
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            // Try audit-related tables
-            let response;
-            const auditTables = [
-                'sys_audit', // Standard audit table
-                'sys_audit_relation', // Audit relationships
-                'syslog_transaction', // Transaction logging
-                'u_audit_rule' // Custom table fallback
-            ];
-            for (const tableName of auditTables) {
-                try {
-                    // Adjust field names for sys_audit
-                    const tableSpecificData = tableName === 'sys_audit' ? {
-                        tablename: args.table,
-                        fieldname: args.fields ? args.fields.join(',') : '*',
-                        reason: args.name,
-                        user: 'system',
-                        record_checkpoint: JSON.stringify({ filter: args.filter || '' })
-                    } : auditData;
-                    response = await this.client.createRecord(tableName, tableSpecificData);
-                    if (response.success) {
-                        this.logger.info(`Audit rule created in table: ${tableName}`);
-                        break;
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-                    continue;
-                }
-            }
-            if (!response.success) {
-                throw new Error(`Failed to create Audit Rule: ${response.error}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Audit Rule created successfully!\n\n📊 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🎯 Events: ${args.events?.join(', ') || 'create, update, delete'}\n📅 Retention: ${args.retention || 365} days\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.fields?.length ? `📝 Fields: ${args.fields.join(', ')}\n` : ''}${args.filter ? `🔍 Filter: ${args.filter}\n` : ''}\n✨ Created with dynamic table and event discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Audit Rule:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Audit Rule: ${error}`);
-        }
-    }
-    /**
-     * Create Access Control with dynamic role discovery
-     */
-    async createAccessControl(args) {
-        try {
-            this.logger.info('Creating Access Control...');
-            // Validate table and discover roles
-            const tableInfo = await this.getTableInfo(args.table);
-            if (!tableInfo) {
-                throw new Error(`Table not found: ${args.table}`);
-            }
-            const availableRoles = await this.getAvailableRoles();
-            const aclData = {
-                name: args.name,
-                table: tableInfo.name,
-                operation: args.operation,
-                roles: JSON.stringify(args.roles || []),
-                condition: args.condition || '',
-                advanced: args.advanced || false,
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            const response = await this.client.createRecord('sys_security_acl', aclData);
-            if (!response.success) {
-                throw new Error(`Failed to create Access Control: ${response.error}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Access Control created successfully!\n\n🔐 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🛠️ Operation: ${args.operation}\n👥 Roles: ${args.roles?.join(', ') || 'None specified'}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n${args.condition ? `🔍 Condition: ${args.condition}\n` : ''}${args.advanced ? '⚙️ Advanced ACL enabled\n' : ''}\n✨ Created with dynamic role discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Access Control:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Access Control: ${error}`);
-        }
-    }
-    /**
-     * Create Data Policy with dynamic field discovery
-     */
-    async createDataPolicy(args) {
-        try {
-            this.logger.info('Creating Data Policy...');
-            // Validate table and fields
-            const tableInfo = await this.getTableInfo(args.table);
-            if (!tableInfo) {
-                throw new Error(`Table not found: ${args.table}`);
-            }
-            const tableFields = await this.getTableFields(args.table);
-            const dataPolicyData = {
-                name: args.name,
-                table: tableInfo.name,
-                fields: JSON.stringify(args.fields || []),
-                classification: args.classification,
-                encryption: args.encryption || false,
-                masking: args.masking || false,
-                retention: args.retention || 2555, // 7 years default
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            // Try data policy related tables
-            let response;
-            const dataPolicyTables = [
-                'sys_data_policy_rule', // Data policy rules
-                'sys_security_acl', // ACL for data security
-                'sys_data_source', // Data source policies
-                'u_data_policy' // Custom table fallback
-            ];
-            for (const tableName of dataPolicyTables) {
-                try {
-                    // Adjust field names based on table
-                    const tableSpecificData = tableName === 'sys_security_acl' ? {
-                        name: args.name,
-                        admin_overrides: false,
-                        active: args.active !== false,
-                        condition: args.fields ? `field IN ${args.fields.join(',')}` : '',
-                        description: `Data policy: ${args.classification}`,
-                        type: 'record',
-                        operation: args.encryption ? 'read' : 'write'
-                    } : dataPolicyData;
-                    response = await this.client.createRecord(tableName, tableSpecificData);
-                    if (response.success) {
-                        this.logger.info(`Data policy created in table: ${tableName}`);
-                        break;
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-                    continue;
-                }
-            }
-            if (!response.success) {
-                throw new Error(`Failed to create Data Policy: ${response.error}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Data Policy created successfully!\n\n📊 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n📋 Table: ${tableInfo.label} (${tableInfo.name})\n🏷️ Classification: ${args.classification}\n📝 Fields: ${args.fields?.join(', ') || 'None specified'}\n${args.encryption ? '🔐 Encryption: Required\n' : ''}${args.masking ? '🎭 Masking: Enabled\n' : ''}📅 Retention: ${args.retention || 2555} days\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n✨ Created with dynamic field discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Data Policy:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Data Policy: ${error}`);
-        }
-    }
-    /**
-     * Create Vulnerability Scan with dynamic discovery
-     */
-    async createVulnerabilityScan(args) {
-        try {
-            this.logger.info('Creating Vulnerability Scan...');
-            // Get available scan types and schedules
-            const scanTypes = await this.getScanTypes();
-            const schedules = await this.getAvailableSchedules();
-            const scanData = {
-                name: args.name,
-                scope: args.scope,
-                schedule: args.schedule || 'weekly',
-                severity: args.severity || 'medium',
-                notifications: JSON.stringify(args.notifications || []),
-                remediation: args.remediation || false,
-                active: args.active !== false
-            };
-            const updateSetResult = await this.client.ensureUpdateSet();
-            // Try vulnerability management tables
-            let response;
-            const vulnTables = [
-                'sn_vul_scan', // Vulnerability Response scans
-                'sn_vul_vulnerability', // Vulnerability records
-                'scan_check_run', // Security scan runs
-                'u_vulnerability_scan' // Custom table fallback
-            ];
-            for (const tableName of vulnTables) {
-                try {
-                    // Adjust field names for vulnerability tables
-                    const tableSpecificData = tableName.startsWith('sn_vul_') ? {
-                        name: args.name,
-                        short_description: args.name,
-                        scan_type: args.scope || 'application',
-                        schedule: args.schedule || 'on_demand',
-                        active: args.active !== false,
-                        auto_remediate: args.remediation === true,
-                        notify_on_complete: args.notifications ? args.notifications.join(',') : ''
-                    } : scanData;
-                    response = await this.client.createRecord(tableName, tableSpecificData);
-                    if (response.success) {
-                        this.logger.info(`Vulnerability scan created in table: ${tableName}`);
-                        break;
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Failed to create in table ${tableName}:`, tableError);
-                    continue;
-                }
-            }
-            if (!response.success) {
-                throw new Error(`Failed to create Vulnerability Scan: ${response.error}`);
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `✅ Vulnerability Scan created successfully!\n\n🔍 **${args.name}**\n🆔 sys_id: ${response.data.sys_id}\n🎯 Scope: ${args.scope}\n📅 Schedule: ${args.schedule || 'weekly'}\n🚨 Min Severity: ${args.severity || 'medium'}\n📧 Notifications: ${args.notifications?.length || 0} recipients\n${args.remediation ? '🔧 Auto-remediation: Enabled\n' : ''}\n🔄 Active: ${args.active !== false ? 'Yes' : 'No'}\n\n✨ Created with dynamic scan configuration discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to create Vulnerability Scan:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to create Vulnerability Scan: ${error}`);
-        }
-    }
-    /**
-     * Discover security frameworks
-     */
-    async discoverSecurityFrameworks(args) {
-        try {
-            this.logger.info('Discovering security frameworks...');
-            const type = args?.type || 'all';
-            const frameworks = [];
-            // Discover Security Frameworks
-            if (type === 'all' || type === 'security') {
-                this.logger.trackAPICall('SEARCH', 'sys_security_framework', 50);
-                const securityFrameworks = await this.client.searchRecords('sys_security_framework', '', 50);
-                if (securityFrameworks.success) {
-                    frameworks.push({
-                        category: 'Security Frameworks',
-                        items: securityFrameworks.data.result.map((fw) => ({
-                            name: fw.name,
-                            type: fw.type,
-                            description: fw.description,
-                            version: fw.version
-                        }))
-                    });
-                }
-            }
-            // Discover Compliance Frameworks
-            if (type === 'all' || type === 'compliance') {
-                this.logger.trackAPICall('SEARCH', 'sys_compliance_framework', 50);
-                const complianceFrameworks = await this.client.searchRecords('sys_compliance_framework', '', 50);
-                if (complianceFrameworks.success) {
-                    frameworks.push({
-                        category: 'Compliance Frameworks',
-                        items: complianceFrameworks.data.result.map((fw) => ({
-                            name: fw.name,
-                            standard: fw.standard,
-                            description: fw.description,
-                            controls: fw.control_count
-                        }))
-                    });
-                }
-            }
-            return {
-                content: [{
-                        type: 'text',
-                        text: `🔍 Discovered Security Frameworks:\n\n${frameworks.map(category => `**${category.category}:**\n${category.items.map(item => `- ${item.name}${item.standard ? ` (${item.standard})` : ''}${item.type ? ` - ${item.type}` : ''}\n  ${item.description || 'No description'}`).join('\n')}`).join('\n\n')}\n\n✨ Total frameworks: ${frameworks.reduce((sum, cat) => sum + cat.items.length, 0)}\n🔍 All frameworks discovered dynamically!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to discover security frameworks:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to discover frameworks: ${error}`);
-        }
-    }
-    /**
-     * Discover security policies
-     */
-    async discoverSecurityPolicies(args) {
-        try {
-            this.logger.info('Discovering security policies...');
-            let query = '';
-            if (args?.category) {
-                query = `category=${args.category}`;
-            }
-            if (args?.active !== undefined) {
-                query += query ? `^active=${args.active}` : `active=${args.active}`;
-            }
-            this.logger.trackAPICall('SEARCH', 'sys_security_policy', 50);
-            const policies = await this.client.searchRecords('sys_security_policy', query, 50);
-            if (!policies.success) {
-                throw new Error('Failed to discover security policies');
-            }
-            const policyTypes = ['Access Control', 'Data Protection', 'Network Security', 'Audit', 'Compliance'];
-            const categorizedPolicies = policyTypes.map(type => ({
-                type,
-                policies: policies.data.result.filter((policy) => policy.type?.toLowerCase().includes(type.toLowerCase()) ||
-                    policy.category?.toLowerCase().includes(type.toLowerCase()))
-            })).filter(cat => cat.policies.length > 0);
-            return {
-                content: [{
-                        type: 'text',
-                        text: `🔒 Discovered Security Policies:\n\n${categorizedPolicies.map(category => `**${category.type} Policies:**\n${category.policies.map((policy) => `- ${policy.name} ${policy.active ? '✅' : '❌'}\n  ${policy.description || 'No description'}\n  Enforcement: ${policy.enforcement || 'Not specified'}`).join('\n')}`).join('\n\n')}\n\n✨ Total policies: ${policies.data.result.length}\n🔍 All policies discovered dynamically!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to discover security policies:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to discover policies: ${error}`);
-        }
-    }
-    /**
-     * Run compliance scan
-     */
-    async runComplianceScan(args) {
-        try {
-            this.logger.info(`Running compliance scan for ${args.framework}...`);
-            // Get compliance framework details
-            const frameworkInfo = await this.getComplianceFrameworkInfo(args.framework);
-            if (!frameworkInfo) {
-                throw new Error(`Compliance framework not found: ${args.framework}`);
-            }
-            // Simulate compliance scan results
-            const scanResults = {
-                framework: args.framework,
-                scope: args.scope || 'instance',
-                timestamp: new Date().toISOString(),
-                total_controls: 45,
-                passed: 38,
-                failed: 5,
-                warnings: 2,
-                score: 84.4,
-                findings: [
-                    { control: 'AC-001', status: 'failed', severity: 'high', description: 'Insufficient access controls on sensitive tables' },
-                    { control: 'AU-002', status: 'failed', severity: 'medium', description: 'Audit logging not enabled for all critical operations' },
-                    { control: 'DP-003', status: 'warning', severity: 'low', description: 'Data retention policy not fully implemented' }
-                ]
-            };
-            return {
-                content: [{
-                        type: 'text',
-                        text: `📊 Compliance Scan Results for **${args.framework}**:\n\n🎯 Scope: ${args.scope || 'instance'}\n📅 Scan Date: ${new Date().toLocaleString()}\n\n📈 **Overall Score: ${scanResults.score}%**\n\n📋 **Control Summary:**\n✅ Passed: ${scanResults.passed}/${scanResults.total_controls}\n❌ Failed: ${scanResults.failed}/${scanResults.total_controls}\n⚠️ Warnings: ${scanResults.warnings}/${scanResults.total_controls}\n\n🚨 **Key Findings:**\n${scanResults.findings.map(finding => `- **${finding.control}** (${finding.severity}): ${finding.description}`).join('\n')}\n\n${args.generateReport ? '📄 Compliance report generated and saved to audit records\n' : ''}\n✨ Scan completed with dynamic compliance framework discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to run compliance scan:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to run compliance scan: ${error}`);
-        }
-    }
-    /**
-     * Audit trail analysis
-     */
-    async auditTrailAnalysis(args) {
-        try {
-            this.logger.info('Analyzing audit trails...');
-            const timeframe = args?.timeframe || '24h';
-            let query = '';
-            if (args?.user) {
-                query = `user=${args.user}`;
-            }
-            if (args?.table) {
-                query += query ? `^table=${args.table}` : `table=${args.table}`;
-            }
-            this.logger.trackAPICall('SEARCH', 'sys_audit', 100);
-            const auditRecords = await this.client.searchRecords('sys_audit', query, 100);
-            if (!auditRecords.success) {
-                throw new Error('Failed to retrieve audit records');
-            }
-            // Analyze audit data
-            const _analysis = {
-                timeframe,
-                total_events: auditRecords.data.result.length,
-                unique_users: new Set(auditRecords.data.result.map((record) => record.user)).size,
-                unique_tables: new Set(auditRecords.data.result.map((record) => record.table)).size,
-                top_activities: this.getTopActivities(auditRecords.data.result),
-                anomalies: args?.anomalies ? this.detectAnomalies(auditRecords.data.result) : []
-            };
-            return {
-                content: [{
-                        type: 'text',
-                        text: `📊 Audit Trail Analysis (${timeframe}):\n\n📈 **Summary:**\n- Total Events: ${_analysis.total_events}\n- Unique Users: ${_analysis.unique_users}\n- Unique Tables: ${_analysis.unique_tables}\n\n🔥 **Top Activities:**\n${_analysis.top_activities.map((activity) => `- ${activity.action} (${activity.count} times)`).join('\n')}\n\n${_analysis.anomalies.length > 0 ?
-                            `🚨 **Anomalies Detected:**\n${_analysis.anomalies.map((anomaly) => `- ${anomaly.type}: ${anomaly.description}`).join('\n')}\n\n` : ''}${args?.exportFormat ? `📤 Export generated in ${args.exportFormat} format\n` : ''}\n✨ Analysis completed with dynamic audit discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to analyze audit trails:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to analyze audit trails: ${error}`);
-        }
-    }
-    /**
-     * Security risk assessment
-     */
-    async securityRiskAssessment(args) {
-        try {
-            this.logger.info('Performing security risk assessment...');
-            const scope = args?.scope || 'instance';
-            const riskLevel = args?.riskLevel || 'medium';
-            // Simulate risk assessment
-            const assessment = {
-                scope,
-                timestamp: new Date().toISOString(),
-                overall_risk: 'medium',
-                risk_score: 6.2,
-                categories: [
-                    { name: 'Access Control', risk: 'high', score: 8.1, issues: 3 },
-                    { name: 'Data Protection', risk: 'medium', score: 5.7, issues: 2 },
-                    { name: 'Network Security', risk: 'low', score: 3.2, issues: 1 },
-                    { name: 'Audit & Compliance', risk: 'medium', score: 6.8, issues: 2 }
-                ],
-                recommendations: [
-                    'Implement additional access controls for sensitive data',
-                    'Enable comprehensive audit logging',
-                    'Update data encryption policies',
-                    'Conduct regular security training'
-                ]
-            };
-            return {
-                content: [{
-                        type: 'text',
-                        text: `🔍 Security Risk Assessment Results:\n\n🎯 Scope: ${scope}\n📅 Assessment Date: ${new Date().toLocaleString()}\n\n📊 **Overall Risk Score: ${assessment.risk_score}/10 (${assessment.overall_risk})**\n\n📋 **Risk Categories:**\n${assessment.categories.map(cat => `- **${cat.name}**: ${cat.risk.toUpperCase()} (${cat.score}/10) - ${cat.issues} issues`).join('\n')}\n\n${args?.generateMitigation ?
-                            `🔧 **Mitigation Recommendations:**\n${assessment.recommendations.map(rec => `- ${rec}`).join('\n')}\n\n` : ''}\n✨ Assessment completed with dynamic security discovery!`
-                    }]
-            };
-        }
-        catch (error) {
-            this.logger.error('Failed to perform security risk assessment:', error);
-            throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Failed to perform risk assessment: ${error}`);
-        }
-    }
-    // Helper methods
-    async getSecurityPolicyTypes() {
-        try {
-            const policyTypes = await this.client.searchRecords('sys_choice', 'name=sys_security_policy^element=type', 20);
-            if (policyTypes.success) {
-                return policyTypes.data.result.map((choice) => choice.value);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover policy types, using defaults');
-        }
-        return ['access', 'data', 'network', 'audit', 'compliance'];
-    }
-    async getEnforcementLevels() {
-        try {
-            const levels = await this.client.searchRecords('sys_choice', 'name=sys_security_policy^element=enforcement', 10);
-            if (levels.success) {
-                return levels.data.result.map((choice) => choice.value);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover enforcement levels, using defaults');
-        }
-        return ['strict', 'moderate', 'advisory'];
-    }
-    async getComplianceFrameworks() {
-        try {
-            const frameworks = await this.client.searchRecords('sys_compliance_framework', '', 20);
-            if (frameworks.success) {
-                return frameworks.data.result.map((fw) => fw.name);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover compliance frameworks, using defaults');
-        }
-        return ['SOX', 'GDPR', 'HIPAA', 'ISO27001', 'PCI-DSS'];
-    }
-    async getTableInfo(tableName) {
-        try {
-            const tableResponse = await this.client.searchRecords('sys_db_object', `name=${tableName}`, 1);
-            if (tableResponse.success && tableResponse.data?.result?.length > 0) {
-                const table = tableResponse.data.result[0];
-                return { name: table.name, label: table.label };
-            }
-            return null;
-        }
-        catch (error) {
-            this.logger.error(`Failed to get table info for ${tableName}:`, error);
-            return null;
-        }
-    }
-    async getTableFields(tableName) {
-        try {
-            const fieldsResponse = await this.client.searchRecords('sys_dictionary', `nameSTARTSWITH${tableName}^element!=NULL`, 100);
-            if (fieldsResponse.success) {
-                return fieldsResponse.data.result.map((field) => field.element);
-            }
-            return [];
-        }
-        catch (error) {
-            this.logger.error(`Failed to get fields for ${tableName}:`, error);
-            return [];
-        }
-    }
-    async getAvailableRoles() {
-        try {
-            const rolesResponse = await this.client.searchRecords('sys_user_role', '', 50);
-            if (rolesResponse.success) {
-                return rolesResponse.data.result.map((role) => role.name);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover roles, using defaults');
-        }
-        return ['admin', 'itil', 'security_admin', 'compliance_manager'];
-    }
-    async getScanTypes() {
-        try {
-            const scanTypes = await this.client.searchRecords('sys_choice', 'name=sys_vulnerability_scan^element=type', 10);
-            if (scanTypes.success) {
-                return scanTypes.data.result.map((choice) => choice.value);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover scan types, using defaults');
-        }
-        return ['application', 'platform', 'integrations', 'network'];
-    }
-    async getAvailableSchedules() {
-        try {
-            const schedules = await this.client.searchRecords('cmn_schedule', '', 20);
-            if (schedules.success) {
-                return schedules.data.result.map((schedule) => schedule.name);
-            }
-        }
-        catch (error) {
-            this.logger.warn('Could not discover schedules, using defaults');
-        }
-        return ['daily', 'weekly', 'monthly'];
-    }
-    async getComplianceFrameworkInfo(framework) {
-        try {
-            const frameworkResponse = await this.client.searchRecords('sys_compliance_framework', `name=${framework}`, 1);
-            if (frameworkResponse.success && frameworkResponse.data?.result?.length > 0) {
-                return frameworkResponse.data.result[0];
-            }
-            return null;
-        }
-        catch (error) {
-            this.logger.error(`Failed to get compliance framework info for ${framework}:`, error);
-            return null;
-        }
-    }
-    getTopActivities(auditRecords) {
-        const activities = auditRecords.reduce((acc, record) => {
-            acc[record.action] = (acc[record.action] || 0) + 1;
-            return acc;
-        }, {});
-        return Object.entries(activities)
-            .sort(([, a], [, b]) => b - a)
-            .slice(0, 5)
-            .map(([action, count]) => ({ action, count }));
-    }
-    detectAnomalies(auditRecords) {
-        // Simple anomaly detection based on unusual patterns
-        const anomalies = [];
-        // Check for unusual user activity
-        const userActivity = auditRecords.reduce((acc, record) => {
-            acc[record.user] = (acc[record.user] || 0) + 1;
-            return acc;
-        }, {});
-        const activityValues = Object.values(userActivity);
-        const avgActivity = activityValues.reduce((sum, count) => sum + count, 0) / Object.keys(userActivity).length;
-        Object.entries(userActivity).forEach(([user, count]) => {
-            if (count > avgActivity * 3) {
-                anomalies.push({
-                    type: 'unusual_user_activity',
-                    description: `User ${user} has ${count} activities (${(count / avgActivity).toFixed(1)}x average)`
-                });
-            }
-        });
-        return anomalies;
-    }
-    /**
-     * Validate security table access and permissions
-     */
-    async validateSecurityAccess() {
-        try {
-            // Check if common security tables exist and are accessible
-            const securityTables = [
-                'sys_security_policy',
-                'sys_security_rule',
-                'sys_policy',
-                'sys_acl'
-            ];
-            for (const tableName of securityTables) {
-                try {
-                    // Try to query the table with minimal data
-                    const testQuery = await this.client.makeRequest({
-                        method: 'GET',
-                        url: `/api/now/table/${tableName}`,
-                        params: {
-                            sysparm_limit: 1,
-                            sysparm_fields: 'sys_id'
-                        }
-                    });
-                    if (testQuery && !testQuery.error) {
-                        this.logger.info(`Security access confirmed for table: ${tableName}`);
-                        return { hasAccess: true };
-                    }
-                }
-                catch (tableError) {
-                    this.logger.warn(`Table ${tableName} not accessible:`, tableError);
-                    continue;
-                }
-            }
-            // No security tables accessible
-            return {
-                hasAccess: false,
-                error: 'No security policy tables found or accessible. Your ServiceNow instance may not have the Security Operations module installed, or you may lack the required permissions (security_admin, admin).'
-            };
-        }
-        catch (error) {
-            this.logger.error('Security access validation failed:', error);
-            return {
-                hasAccess: false,
-                error: `Security validation failed: ${error?.message || 'Unknown error'}`
-            };
-        }
-    }
-    async run() {
-        const transport = new stdio_js_1.StdioServerTransport();
-        await this.server.connect(transport);
-        this.logger.info('ServiceNow Security & Compliance MCP Server running on stdio');
-    }
-}
-const server = new ServiceNowSecurityComplianceMCP();
-server.run().catch(console.error);
-//# sourceMappingURL=servicenow-security-compliance-mcp.js.map