vaspera 2.13.0 → 2.15.0

package/dist/certification/agent-certificate-sample.js

@@ -0,0 +1,207 @@
+/**
+ * Sample agent certificate builder.
+ *
+ * Produces a realistic certificate body for the Vaspera Hardening MCP
+ * server itself — the dogfood. It reflects the actual hardened state of
+ * this codebase, so the sample doubles as proof the platform certifies
+ * its own primary use case.
+ *
+ * @module certification/agent-certificate-sample
+ */
+import { AGENT_CERTIFICATE_SCHEMA } from "./agent-certificate.js";
+/**
+ * Build a sample certificate body certifying the vaspera-hardening MCP
+ * server. Values mirror the real hardening work landed this cycle.
+ */
+export function buildSampleCertificateBody(options) {
+    const { toolVersion, issuedAt, expiresAt, certificateId } = options;
+    return {
+        schemaVersion: AGENT_CERTIFICATE_SCHEMA,
+        certificateId,
+        subject: {
+            kind: "mcp-server",
+            name: "vaspera-hardening-mcp-server",
+            version: toolVersion,
+            identifier: "https://github.com/RCOLKITT/hardening-mcp",
+            description: "MCP server that certifies AI-generated code and AI agents for production readiness.",
+        },
+        issuer: {
+            name: "Vaspera",
+            tool: "vaspera-hardening-mcp",
+            toolVersion,
+            actor: { type: "system", id: "vaspera-self-certification" },
+        },
+        issuedAt,
+        expiresAt,
+        level: "CERTIFIED",
+        overallScore: 94,
+        dimensions: {
+            security: {
+                status: "pass",
+                score: 96,
+                summary: "Bearer-auth enforced on the HTTP surface, command injection eliminated across scanner adapters, untrusted paths contained, secrets redacted in logs.",
+                checks: [
+                    {
+                        id: "http-auth-required",
+                        title: "HTTP MCP endpoint requires a bearer token (fails closed)",
+                        status: "pass",
+                        severity: "critical",
+                        category: "auth-bypass",
+                    },
+                    {
+                        id: "no-shell-exec",
+                        title: "Scanner adapters use execFile (no string-concat shell)",
+                        status: "pass",
+                        severity: "critical",
+                        category: "command-injection",
+                    },
+                    {
+                        id: "path-containment",
+                        title: "project_path and secondary file args are containment-checked",
+                        status: "pass",
+                        severity: "high",
+                        category: "path-traversal",
+                    },
+                    {
+                        id: "http-tool-policy",
+                        title: "Only read-only tools are exposed over HTTP by default",
+                        status: "pass",
+                        severity: "high",
+                        category: "excessive-agency",
+                    },
+                    {
+                        id: "log-redaction",
+                        title: "Secrets (incl. embedded tokens) redacted from logs",
+                        status: "pass",
+                        severity: "medium",
+                        category: "sensitive-disclosure",
+                    },
+                ],
+            },
+            scalability: {
+                status: "pass",
+                score: 88,
+                summary: "Stateless per-request transport with a serialization mutex and a hard request timeout; no unbounded request bodies.",
+                checks: [
+                    {
+                        id: "request-timeout",
+                        title: "Per-request timeout prevents a hung handler from wedging the endpoint",
+                        status: "pass",
+                        severity: "high",
+                        category: "resource-exhaustion",
+                    },
+                    {
+                        id: "body-size-cap",
+                        title: "Request bodies capped at 10MB",
+                        status: "pass",
+                        severity: "medium",
+                    },
+                    {
+                        id: "load-profile",
+                        title: "Sustained-load profile not yet benchmarked",
+                        status: "warn",
+                        severity: "low",
+                        detail: "Scalability benchmark is a planned addition.",
+                    },
+                ],
+            },
+            quality: {
+                status: "pass",
+                score: 93,
+                summary: "TypeScript strict mode, 1800+ passing tests, and a constitution-as-code ratchet that blocks new shell-exec / raw JSON.parse / bare throws.",
+                checks: [
+                    {
+                        id: "tests-green",
+                        title: "Full test suite passes (97 files / 1839 tests)",
+                        status: "pass",
+                    },
+                    {
+                        id: "constitution-ratchet",
+                        title: "Constitution baseline ratchet enforced in CI",
+                        status: "pass",
+                    },
+                    {
+                        id: "self-certify-gate",
+                        title: "Self-certification is a blocking CI gate",
+                        status: "pass",
+                    },
+                    {
+                        id: "debt-baseline",
+                        title: "Legacy JSON.parse/throw debt grandfathered (burning down)",
+                        status: "warn",
+                        severity: "low",
+                    },
+                ],
+            },
+            explainability: {
+                status: "pass",
+                score: 90,
+                summary: "Tamper-evident hash-chained audit trail records certification decisions; findings carry evidence and reproducible scoring.",
+                checks: [
+                    {
+                        id: "audit-hash-chain",
+                        title: "Decision/audit entries are hash-chained (tamper-evident)",
+                        status: "pass",
+                        severity: "high",
+                    },
+                    {
+                        id: "signed-evidence",
+                        title: "Evidence bundles are digest-addressed and Sigstore-signable",
+                        status: "pass",
+                    },
+                    {
+                        id: "decision-provenance",
+                        title: "Per-decision runtime provenance capture (planned extension)",
+                        status: "warn",
+                        severity: "low",
+                    },
+                ],
+            },
+            compliance: {
+                status: "pass",
+                score: 91,
+                summary: "Mapped to OWASP LLM Top 10 today; ISO 42001 / NIST AI RMF mappings staged as the next certification-layer addition.",
+                frameworks: [
+                    {
+                        framework: "OWASP-LLM",
+                        controlsTotal: 10,
+                        controlsSatisfied: 9,
+                        controlsAtRisk: 1,
+                        controlsFailed: 0,
+                    },
+                    {
+                        framework: "NIST-AI-RMF",
+                        controlsTotal: 4,
+                        controlsSatisfied: 3,
+                        controlsAtRisk: 1,
+                        controlsFailed: 0,
+                        controls: [
+                            { controlId: "GOVERN", title: "Governance & policy", status: "satisfied" },
+                            { controlId: "MAP", title: "Context mapping", status: "satisfied" },
+                            { controlId: "MEASURE", title: "Measurement & metrics", status: "at_risk" },
+                            { controlId: "MANAGE", title: "Risk management", status: "satisfied" },
+                        ],
+                    },
+                ],
+            },
+            aiBom: {
+                status: "pass",
+                score: 92,
+                summary: "Deterministic scanners + multi-model consensus + agent-security scanners; 110 MCP tools enumerated.",
+                components: [
+                    { name: "semgrep", kind: "tool", role: "SAST scanner" },
+                    { name: "trivy", kind: "tool", role: "SCA / IaC scanner" },
+                    { name: "gitleaks", kind: "tool", role: "secret scanner" },
+                    { name: "prompt-injection-fuzzer", kind: "tool", role: "agent-security scanner" },
+                    { name: "exfil-path-graph", kind: "tool", role: "agent-security scanner" },
+                    { name: "multi-model-consensus", kind: "model", role: "LLM analysis consensus" },
+                ],
+            },
+        },
+        provenance: {
+            decisionRecords: 0,
+        },
+        evidence: [],
+    };
+}
+//# sourceMappingURL=agent-certificate-sample.js.map

package/dist/certification/agent-certificate-sample.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-certificate-sample.js","sourceRoot":"","sources":["../../src/certification/agent-certificate-sample.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAYlE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAsB;IAC/D,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAEpE,OAAO;QACL,aAAa,EAAE,wBAAwB;QACvC,aAAa;QACb,OAAO,EAAE;YACP,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,2CAA2C;YACvD,WAAW,EACT,qFAAqF;SACxF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,uBAAuB;YAC7B,WAAW;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,4BAA4B,EAAE;SAC5D;QACD,QAAQ;QACR,SAAS;QACT,KAAK,EAAE,WAAW;QAClB,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE;YACV,QAAQ,EAAE;gBACR,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,sJAAsJ;gBACxJ,MAAM,EAAE;oBACN;wBACE,EAAE,EAAE,oBAAoB;wBACxB,KAAK,EAAE,0DAA0D;wBACjE,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,aAAa;qBACxB;oBACD;wBACE,EAAE,EAAE,eAAe;wBACnB,KAAK,EAAE,wDAAwD;wBAC/D,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,mBAAmB;qBAC9B;oBACD;wBACE,EAAE,EAAE,kBAAkB;wBACtB,KAAK,EAAE,8DAA8D;wBACrE,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,gBAAgB;qBAC3B;oBACD;wBACE,EAAE,EAAE,kBAAkB;wBACtB,KAAK,EAAE,uDAAuD;wBAC9D,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,kBAAkB;qBAC7B;oBACD;wBACE,EAAE,EAAE,eAAe;wBACnB,KAAK,EAAE,oDAAoD;wBAC3D,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,QAAQ;wBAClB,QAAQ,EAAE,sBAAsB;qBACjC;iBACF;aACF;YACD,WAAW,EAAE;gBACX,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,qHAAqH;gBACvH,MAAM,EAAE;oBACN;wBACE,EAAE,EAAE,iBAAiB;wBACrB,KAAK,EAAE,uEAAuE;wBAC9E,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,MAAM;wBAChB,QAAQ,EAAE,qBAAqB;qBAChC;oBACD;wBACE,EAAE,EAAE,eAAe;wBACnB,KAAK,EAAE,+BAA+B;wBACtC,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,QAAQ;qBACnB;oBACD;wBACE,EAAE,EAAE,cAAc;wBAClB,KAAK,EAAE,4CAA4C;wBACnD,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,8CAA8C;qBACvD;iBACF;aACF;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,4IAA4I;gBAC9I,MAAM,EAAE;oBACN;wBACE,EAAE,EAAE,aAAa;wBACjB,KAAK,EAAE,gDAAgD;wBACvD,MAAM,EAAE,MAAM;qBACf;oBACD;wBACE,EAAE,EAAE,sBAAsB;wBAC1B,KAAK,EAAE,8CAA8C;wBACrD,MAAM,EAAE,MAAM;qBACf;oBACD;wBACE,EAAE,EAAE,mBAAmB;wBACvB,KAAK,EAAE,0CAA0C;wBACjD,MAAM,EAAE,MAAM;qBACf;oBACD;wBACE,EAAE,EAAE,eAAe;wBACnB,KAAK,EAAE,2DAA2D;wBAClE,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF;YACD,cAAc,EAAE;gBACd,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,4HAA4H;gBAC9H,MAAM,EAAE;oBACN;wBACE,EAAE,EAAE,kBAAkB;wBACtB,KAAK,EAAE,0DAA0D;wBACjE,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,MAAM;qBACjB;oBACD;wBACE,EAAE,EAAE,iBAAiB;wBACrB,KAAK,EAAE,6DAA6D;wBACpE,MAAM,EAAE,MAAM;qBACf;oBACD;wBACE,EAAE,EAAE,qBAAqB;wBACzB,KAAK,EAAE,6DAA6D;wBACpE,MAAM,EAAE,MAAM;wBACd,QAAQ,EAAE,KAAK;qBAChB;iBACF;aACF;YACD,UAAU,EAAE;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,qHAAqH;gBACvH,UAAU,EAAE;oBACV;wBACE,SAAS,EAAE,WAAW;wBACtB,aAAa,EAAE,EAAE;wBACjB,iBAAiB,EAAE,CAAC;wBACpB,cAAc,EAAE,CAAC;wBACjB,cAAc,EAAE,CAAC;qBAClB;oBACD;wBACE,SAAS,EAAE,aAAa;wBACxB,aAAa,EAAE,CAAC;wBAChB,iBAAiB,EAAE,CAAC;wBACpB,cAAc,EAAE,CAAC;wBACjB,cAAc,EAAE,CAAC;wBACjB,QAAQ,EAAE;4BACR,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,EAAE;4BAC1E,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE;4BACnE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,SAAS,EAAE;4BAC3E,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE;yBACvE;qBACF;iBACF;aACF;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,EAAE;gBACT,OAAO,EACL,qGAAqG;gBACvG,UAAU,EAAE;oBACV,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;oBACvD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;oBAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;oBAC1D,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE;oBACjF,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE;oBAC1E,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE;iBACjF;aACF;SACF;QACD,UAAU,EAAE;YACV,eAAe,EAAE,CAAC;SACnB;QACD,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC"}