specforge-mcp 0.1.0

package/dist/config/saas-registry.json

@@ -0,0 +1,183 @@
+{
+  "databases": {
+    "supabase": {
+      "name": "Supabase",
+      "type": "baas",
+      "engine": "postgresql",
+      "docsUrl": "https://supabase.com/docs",
+      "features": ["auth", "storage", "realtime", "edge-functions", "rls", "vector"],
+      "mcpAvailable": true,
+      "sdks": {
+        "javascript": "@supabase/supabase-js",
+        "python": "supabase",
+        "dart": "supabase_flutter",
+        "swift": "supabase-swift"
+      }
+    },
+    "firebase": {
+      "name": "Firebase",
+      "type": "baas",
+      "engine": "firestore",
+      "docsUrl": "https://firebase.google.com/docs",
+      "features": ["auth", "storage", "realtime", "cloud-functions", "security-rules", "hosting"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "firebase",
+        "python": "firebase-admin",
+        "dart": "firebase_core",
+        "swift": "FirebaseFirestore"
+      }
+    },
+    "planetscale": {
+      "name": "PlanetScale",
+      "type": "managed-db",
+      "engine": "mysql",
+      "docsUrl": "https://planetscale.com/docs",
+      "features": ["branching", "deploy-requests", "insights", "boost"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@planetscale/database"
+      }
+    },
+    "neon": {
+      "name": "Neon",
+      "type": "managed-db",
+      "engine": "postgresql",
+      "docsUrl": "https://neon.tech/docs",
+      "features": ["branching", "autoscaling", "serverless-driver", "logical-replication"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@neondatabase/serverless"
+      }
+    },
+    "turso": {
+      "name": "Turso",
+      "type": "managed-db",
+      "engine": "sqlite",
+      "docsUrl": "https://docs.turso.tech",
+      "features": ["edge-replicas", "embedded-replicas", "vector"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@libsql/client",
+        "python": "libsql-client",
+        "rust": "libsql"
+      }
+    },
+    "xata": {
+      "name": "Xata",
+      "type": "managed-db",
+      "engine": "postgresql",
+      "docsUrl": "https://xata.io/docs",
+      "features": ["search", "analytics", "branching", "file-attachments"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@xata.io/client"
+      }
+    },
+    "cockroachdb": {
+      "name": "CockroachDB",
+      "type": "managed-db",
+      "engine": "postgresql",
+      "docsUrl": "https://www.cockroachlabs.com/docs",
+      "features": ["multi-region", "serializable-isolation", "auto-scaling"],
+      "mcpAvailable": false,
+      "sdks": {}
+    },
+    "mongodb-atlas": {
+      "name": "MongoDB Atlas",
+      "type": "managed-db",
+      "engine": "mongodb",
+      "docsUrl": "https://www.mongodb.com/docs/atlas",
+      "features": ["search", "vector-search", "charts", "triggers", "sync"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "mongodb",
+        "python": "pymongo"
+      }
+    }
+  },
+  "payments": {
+    "stripe": {
+      "name": "Stripe",
+      "docsUrl": "https://docs.stripe.com",
+      "features": ["payments", "subscriptions", "invoicing", "connect", "tax"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "stripe",
+        "python": "stripe",
+        "ruby": "stripe"
+      }
+    },
+    "lemonsqueezy": {
+      "name": "Lemon Squeezy",
+      "docsUrl": "https://docs.lemonsqueezy.com",
+      "features": ["payments", "subscriptions", "digital-products", "tax"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@lemonsqueezy/lemonsqueezy.js"
+      }
+    }
+  },
+  "auth": {
+    "clerk": {
+      "name": "Clerk",
+      "docsUrl": "https://clerk.com/docs",
+      "features": ["auth", "user-management", "organizations", "webhooks"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@clerk/nextjs"
+      }
+    },
+    "auth0": {
+      "name": "Auth0",
+      "docsUrl": "https://auth0.com/docs",
+      "features": ["auth", "sso", "mfa", "user-management"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@auth0/nextjs-auth0"
+      }
+    }
+  },
+  "email": {
+    "resend": {
+      "name": "Resend",
+      "docsUrl": "https://resend.com/docs",
+      "features": ["transactional-email", "react-email", "domains"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "resend",
+        "python": "resend"
+      }
+    },
+    "sendgrid": {
+      "name": "SendGrid",
+      "docsUrl": "https://docs.sendgrid.com",
+      "features": ["transactional-email", "marketing", "templates"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@sendgrid/mail"
+      }
+    }
+  },
+  "monitoring": {
+    "sentry": {
+      "name": "Sentry",
+      "docsUrl": "https://docs.sentry.io",
+      "features": ["error-tracking", "performance", "session-replay", "cron"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "@sentry/nextjs",
+        "python": "sentry-sdk"
+      }
+    },
+    "posthog": {
+      "name": "PostHog",
+      "docsUrl": "https://posthog.com/docs",
+      "features": ["analytics", "feature-flags", "session-replay", "experiments"],
+      "mcpAvailable": false,
+      "sdks": {
+        "javascript": "posthog-js"
+      }
+    }
+  }
+}

package/dist/config/security-patterns.json

@@ -0,0 +1,282 @@
+{
+  "_description": "Security patterns config for SPEC-029: insecure code patterns and OWASP criteria per feature type",
+  "insecurePatterns": [
+    {
+      "id": "sql-concat",
+      "name": "SQL string concatenation",
+      "regex": "(?:query|sql|execute)\\s*[\\+=].*['\"].*\\+.*(?:req|params|body|input|user)",
+      "severity": "critical",
+      "remediation": "Use parameterized queries or an ORM with built-in protection (e.g., prisma, knex, sqlalchemy)"
+    },
+    {
+      "id": "hardcoded-secret",
+      "name": "Hardcoded secret or credential",
+      "regex": "(?:password|passwd|secret|api_key|apikey|token|private_key)\\s*=\\s*['\"][^'\"]{6,}['\"]",
+      "severity": "critical",
+      "remediation": "Move secrets to environment variables; use a secrets manager (Vault, AWS Secrets Manager)"
+    },
+    {
+      "id": "md5-usage",
+      "name": "Weak hash algorithm MD5",
+      "regex": "(?:md5|MD5)\\s*\\(",
+      "severity": "high",
+      "remediation": "Replace MD5 with SHA-256 or bcrypt/argon2 for passwords"
+    },
+    {
+      "id": "sha1-usage",
+      "name": "Weak hash algorithm SHA1",
+      "regex": "(?:sha1|SHA1|createHash\\(['\"]sha1['\"]\\))",
+      "severity": "high",
+      "remediation": "Replace SHA1 with SHA-256 or SHA-3 for integrity; bcrypt/argon2 for passwords"
+    },
+    {
+      "id": "eval-usage",
+      "name": "eval() usage",
+      "regex": "\\beval\\s*\\(",
+      "severity": "critical",
+      "remediation": "Remove eval(); use JSON.parse() for data, or structured alternatives"
+    },
+    {
+      "id": "inner-html",
+      "name": "innerHTML assignment",
+      "regex": "\\.innerHTML\\s*=",
+      "severity": "high",
+      "remediation": "Use textContent or DOMPurify.sanitize() before assigning innerHTML; avoid it when possible"
+    },
+    {
+      "id": "unvalidated-req-params",
+      "name": "Unvalidated req.params in route",
+      "regex": "req\\.params\\.\\w+.*(?:query|exec|find|update|delete|insert|db\\.|mongo\\.|sql)",
+      "severity": "high",
+      "remediation": "Validate and sanitize req.params before using in DB operations; use express-validator or Zod"
+    },
+    {
+      "id": "http-basic-auth",
+      "name": "HTTP Basic Auth in production",
+      "regex": "Authorization.*Basic|basicAuth\\(",
+      "severity": "medium",
+      "remediation": "Use token-based authentication (JWT, OAuth2) instead of Basic Auth in production"
+    }
+  ],
+  "owaspCriteriaByProfile": {
+    "public-api": [
+      {
+        "owasp": "A01-broken-access-control",
+        "description": "Authentication is required for all non-public endpoints",
+        "rationale": "Public APIs without auth allow unauthorized access to protected resources"
+      },
+      {
+        "owasp": "A01-broken-access-control",
+        "description": "Authorization is enforced per role — users can only access their own resources",
+        "rationale": "Missing authorization checks are the #1 OWASP vulnerability"
+      },
+      {
+        "owasp": "A05-security-misconfiguration",
+        "description": "Rate limiting is applied with defined limits (e.g., 100 req/min per IP)",
+        "rationale": "Without rate limiting, public APIs are vulnerable to DoS and brute force"
+      },
+      {
+        "owasp": "A05-security-misconfiguration",
+        "description": "Security headers are present: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security",
+        "rationale": "Security headers protect against XSS, clickjacking, and MITM attacks"
+      },
+      {
+        "owasp": "A04-insecure-design",
+        "description": "Error responses do not expose stack traces or internal system details",
+        "rationale": "Stack traces in error responses leak implementation details useful to attackers"
+      }
+    ],
+    "auth": [
+      {
+        "owasp": "A07-auth-failures",
+        "description": "Authentication tokens have defined expiration times",
+        "rationale": "Long-lived tokens increase the attack window if compromised"
+      },
+      {
+        "owasp": "A07-auth-failures",
+        "description": "Refresh token rotation is implemented — old tokens are invalidated on refresh",
+        "rationale": "Refresh token reuse attacks are prevented by rotation"
+      },
+      {
+        "owasp": "A07-auth-failures",
+        "description": "Token blacklisting is implemented for logout and revocation",
+        "rationale": "Without blacklisting, stolen tokens remain valid until expiry"
+      },
+      {
+        "owasp": "A01-broken-access-control",
+        "description": "Account lockout or progressive delay is applied after N failed attempts",
+        "rationale": "Prevents brute force attacks against authentication"
+      }
+    ],
+    "db-access": [
+      {
+        "owasp": "A03-injection",
+        "description": "All database queries use parameterized statements or prepared queries",
+        "rationale": "SQL injection via string concatenation is the classic A03 vulnerability"
+      },
+      {
+        "owasp": "A03-injection",
+        "description": "All user input is validated and sanitized before being stored in the database",
+        "rationale": "Unvalidated input enables injection attacks and data corruption"
+      },
+      {
+        "owasp": "A01-broken-access-control",
+        "description": "Database connection uses minimum necessary permissions (principle of least privilege)",
+        "rationale": "Overprivileged DB accounts allow attackers to escalate impact if they compromise the app"
+      },
+      {
+        "owasp": "A02-cryptographic-failures",
+        "description": "Sensitive data (PII, passwords, keys) is encrypted at rest",
+        "rationale": "Unencrypted data at rest is exposed if storage is compromised"
+      }
+    ],
+    "file-upload": [
+      {
+        "owasp": "A04-insecure-design",
+        "description": "Uploaded files are validated for type, size, and content (not just extension)",
+        "rationale": "Extension-only validation can be bypassed; content-type sniffing is required"
+      },
+      {
+        "owasp": "A05-security-misconfiguration",
+        "description": "Uploaded files are stored outside the web root and not served with execute permissions",
+        "rationale": "Executable uploads in web-accessible paths enable remote code execution"
+      },
+      {
+        "owasp": "A03-injection",
+        "description": "File names are sanitized before storage — path traversal characters are removed",
+        "rationale": "Unsanitized filenames enable path traversal attacks"
+      }
+    ],
+    "html-render": [
+      {
+        "owasp": "A03-injection",
+        "description": "All user-supplied content is escaped before rendering in HTML",
+        "rationale": "Unescaped user content enables XSS attacks"
+      },
+      {
+        "owasp": "A05-security-misconfiguration",
+        "description": "Content-Security-Policy header restricts allowed script sources",
+        "rationale": "CSP provides defense-in-depth against XSS even if output escaping fails"
+      }
+    ],
+    "pii-data": [
+      {
+        "owasp": "A02-cryptographic-failures",
+        "description": "PII fields (email, phone, SSN, DOB) are encrypted at rest",
+        "rationale": "GDPR and privacy regulations require encryption of personal data at rest"
+      },
+      {
+        "owasp": "A09-logging",
+        "description": "PII data is redacted in logs — no full email, phone, or SSN in log files",
+        "rationale": "Log files are often less protected than databases; PII in logs creates compliance risk"
+      },
+      {
+        "owasp": "A01-broken-access-control",
+        "description": "Access to PII requires explicit authorization — not accessible by default",
+        "rationale": "PII should be accessible only to roles that explicitly need it"
+      }
+    ]
+  },
+  "authMechanismCriteria": {
+    "jwt": [
+      "JWT tokens have a defined expiration (exp claim) — maximum 1 hour for access tokens",
+      "Refresh token rotation is implemented — refreshing a token invalidates the old refresh token",
+      "Token blacklisting is available for immediate revocation (logout, password change)",
+      "JWT secret/private key is stored in environment variables, never in source code",
+      "Algorithm is explicitly set to RS256 or HS256 — 'none' algorithm is rejected"
+    ],
+    "oauth2": [
+      "State parameter is validated to prevent CSRF in OAuth2 authorization code flow",
+      "PKCE is implemented for public clients (mobile apps, SPAs) to prevent authorization code interception",
+      "Access tokens are not stored in localStorage — use sessionStorage or HttpOnly cookies",
+      "Token endpoint is authenticated — client_secret is not exposed in client-side code",
+      "Redirect URIs are whitelisted — no open redirect vulnerability"
+    ],
+    "api-key": [
+      "API keys are stored as hashed values in the database (bcrypt or SHA-256)",
+      "API key rotation policy is defined — keys can be rotated without downtime",
+      "API keys are scoped to minimum necessary permissions",
+      "Compromised API keys can be immediately revoked",
+      "API keys are transmitted via headers, not URL query parameters"
+    ],
+    "session": [
+      "Session cookies have HttpOnly flag set to prevent JavaScript access",
+      "Session cookies have Secure flag set — only transmitted over HTTPS",
+      "Session cookies have SameSite=Strict or Lax to prevent CSRF",
+      "Session ID is regenerated on login to prevent session fixation",
+      "Session timeout is defined — idle sessions are invalidated after N minutes"
+    ]
+  },
+  "strideThreats": {
+    "auth": [
+      {
+        "category": "spoofing",
+        "scenario": "Attacker replays a captured authentication token to impersonate a legitimate user",
+        "cvssRange": "7.0-9.0",
+        "mitigation": "Short token expiry, token binding, or refresh token rotation"
+      },
+      {
+        "category": "elevation-of-privilege",
+        "scenario": "Attacker modifies JWT payload (e.g., role: admin) if signature validation is bypassed",
+        "cvssRange": "8.0-10.0",
+        "mitigation": "Always verify JWT signature; reject 'none' algorithm; use asymmetric keys"
+      }
+    ],
+    "payment": [
+      {
+        "category": "tampering",
+        "scenario": "Attacker modifies payment amount in transit between client and server",
+        "cvssRange": "8.5-9.5",
+        "mitigation": "Validate all payment amounts server-side; never trust client-provided amounts"
+      },
+      {
+        "category": "repudiation",
+        "scenario": "User denies making a payment — no audit trail to prove otherwise",
+        "cvssRange": "5.0-7.0",
+        "mitigation": "Maintain immutable payment audit log with user ID, amount, timestamp, and idempotency key"
+      }
+    ],
+    "admin": [
+      {
+        "category": "elevation-of-privilege",
+        "scenario": "Regular user accesses admin endpoint by guessing or enumerating admin URLs",
+        "cvssRange": "7.5-9.5",
+        "mitigation": "Enforce role-based authorization on all admin routes; log unauthorized access attempts"
+      },
+      {
+        "category": "information-disclosure",
+        "scenario": "Admin endpoints expose sensitive user data without proper audit logging",
+        "cvssRange": "5.0-7.5",
+        "mitigation": "Log all admin data access; implement data access alerts for bulk queries"
+      }
+    ]
+  },
+  "complianceCriteria": {
+    "hipaa": [
+      "Audit log records user ID, action, timestamp, and resource affected for all PHI access",
+      "PHI (Protected Health Information) is encrypted at rest using AES-256 or equivalent",
+      "PHI is encrypted in transit using TLS 1.2+ — TLS 1.0/1.1 are disabled",
+      "Access to PHI is controlled with authentication and role-based authorization",
+      "Automatic session timeout after 15-30 minutes of inactivity for PHI systems"
+    ],
+    "pci-dss": [
+      "Full card number (PAN) is never stored after authorization — only last 4 digits",
+      "TLS 1.2+ is required for all cardholder data transmission",
+      "Cryptographic key rotation policy is defined and documented",
+      "Payment processing is isolated in a separate network segment (PCI scope reduction)",
+      "All access to cardholder data is logged with user ID and timestamp"
+    ],
+    "fedramp": [
+      "System uses FIPS 140-2 validated cryptographic modules",
+      "Continuous monitoring reports are generated at defined intervals",
+      "Incident response plan includes federal agency notification procedures",
+      "Data is stored only in FedRAMP-authorized cloud regions"
+    ],
+    "soc2": [
+      "Access reviews are conducted quarterly — terminated employees lose access within 24h",
+      "Security events are logged and retained for minimum 12 months",
+      "Disaster recovery plan is documented and tested annually",
+      "Vendor security assessments are conducted for critical third-party integrations"
+    ]
+  }
+}

package/dist/config/spec-templates.json

@@ -0,0 +1,125 @@
+{
+  "huTemplates": {
+    "feature": {
+      "descriptionFormat": "As a {role}, I want {goal}, so that {benefit}.",
+      "sections": ["Description", "Acceptance Criteria", "Out of Scope", "Dependencies", "Tags"]
+    },
+    "bugfix": {
+      "descriptionFormat": "Bug: {description}.\n\n**Expected behavior:** {expected}\n\n**Actual behavior:** {actual}\n\n**Steps to reproduce:**\n1. {steps}",
+      "sections": [
+        "Bug Description",
+        "Steps to Reproduce",
+        "Expected vs Actual",
+        "Root Cause Analysis",
+        "Fix Criteria",
+        "Regression Tests",
+        "Dependencies",
+        "Tags"
+      ]
+    },
+    "refactor": {
+      "descriptionFormat": "Refactoring: {what}.\n\nMotivation: {motivation}\n\nExpected improvements: {improvements}",
+      "sections": [
+        "Refactoring Description",
+        "Motivation",
+        "Current State",
+        "Target State",
+        "Acceptance Criteria",
+        "Migration Plan",
+        "Dependencies",
+        "Tags"
+      ]
+    },
+    "infra": {
+      "descriptionFormat": "Infrastructure change: {description}.\n\nEnvironments affected: {environments}\n\nRollback plan: {rollback}",
+      "sections": [
+        "Infrastructure Description",
+        "Environments Affected",
+        "Schema Changes",
+        "Acceptance Criteria",
+        "Rollback Plan",
+        "Dependencies",
+        "Tags"
+      ]
+    },
+    "docs": {
+      "descriptionFormat": "Documentation: {description}.\n\nTarget audience: {audience}\n\nFormat: {format}",
+      "sections": [
+        "Documentation Description",
+        "Target Audience",
+        "Content Outline",
+        "Acceptance Criteria",
+        "Dependencies",
+        "Tags"
+      ]
+    },
+    "project": {
+      "descriptionFormat": "Project: {description}.\n\nObjective: {objective}\n\nTimeline: {timeline}",
+      "sections": ["Description", "Objective", "Acceptance Criteria", "Dependencies", "Tags"]
+    }
+  },
+  "fichaTemplates": {
+    "trivial": {
+      "sections": ["Metadata", "Estimation", "Files", "Verification"],
+      "excludeSections": ["DataFlow", "Interfaces", "Behavior"]
+    },
+    "feature": {
+      "sections": [
+        "Metadata",
+        "Estimation",
+        "Interfaces",
+        "Behavior",
+        "DataFlow",
+        "Files",
+        "Verification",
+        "TechnicalNotes",
+        "PostImplementation"
+      ],
+      "excludeSections": []
+    },
+    "cross-module": {
+      "sections": [
+        "Metadata",
+        "Estimation",
+        "AffectedModules",
+        "Interfaces",
+        "Behavior",
+        "DataFlow",
+        "Files",
+        "Verification",
+        "TechnicalNotes",
+        "PostImplementation"
+      ],
+      "excludeSections": []
+    },
+    "architectural": {
+      "sections": [
+        "Metadata",
+        "Estimation",
+        "ArchitecturalImpact",
+        "AffectedModules",
+        "Interfaces",
+        "Behavior",
+        "DataFlow",
+        "Files",
+        "Verification",
+        "TechnicalNotes",
+        "PostImplementation"
+      ],
+      "excludeSections": []
+    }
+  },
+  "stackTerminology": {
+    "typescript": { "types": "Interfaces/Types", "models": "Interfaces", "structLabel": "TypeScript Interfaces" },
+    "javascript": { "types": "Types/JSDoc", "models": "Schemas", "structLabel": "JavaScript Schemas" },
+    "python": { "types": "Models/Types", "models": "Models", "structLabel": "Python Models" },
+    "go": { "types": "Structs", "models": "Structs", "structLabel": "Go Structs" },
+    "rust": { "types": "Structs/Enums", "models": "Structs", "structLabel": "Rust Structs" },
+    "java": { "types": "Classes/Interfaces", "models": "POJOs", "structLabel": "Java Classes" },
+    "kotlin": { "types": "Data Classes/Interfaces", "models": "Data Classes", "structLabel": "Kotlin Data Classes" },
+    "swift": { "types": "Structs/Protocols", "models": "Structs", "structLabel": "Swift Structs" },
+    "csharp": { "types": "Classes/Interfaces", "models": "Models", "structLabel": "C# Classes" },
+    "ruby": { "types": "Classes/Modules", "models": "Models", "structLabel": "Ruby Classes" },
+    "php": { "types": "Classes/Interfaces", "models": "Models", "structLabel": "PHP Classes" }
+  }
+}