visus-mcp 0.16.0 → 0.25.1

package/.env.example

@@ -28,6 +28,13 @@ AUDIT_FAIL_CLOSED=false
 # Set to "false" to disable audit logging (dev/test only)
 VISUS_AUDIT_ENABLED=true
 
+# =======================================
+# Stateful Scan Configuration (optional)
+# =======================================
+
+# Enable multi-turn priming detection (default: false)
+VISUS_STATEFUL_SCAN=true
+
 # =======================================
 # Browser Configuration (optional)
 # =======================================

package/CLAUDE.md

@@ -298,6 +298,19 @@ When a root cause is confirmed, add it here. Future sessions check this list fir
 | Error | Root Cause | Fix | Date Confirmed |
 |-------|-----------|-----|----------------|
 | `ERR_MODULE_NOT_FOUND: @modelcontextprotocol/sdk` in Lambda | `index.js` (MCP stdio server) included in Lambda bundle via `package.json` `"main"` field; SDK not bundled | Add `@modelcontextprotocol/sdk` to `externalModules` in `infrastructure/stack.ts` | 2026-03-24 |
+| CVE-2026-32622: SQLBot RCE via stored terms | Injected SQL in DB descriptions leads to LLM-executed RCE (COPY TO PROGRAM) | Implement db-guard middleware (visus_db_sanitize + postLlmToolGuard); blocks via sqlRisk >0.7; Tests: db-guard.test.ts (10 cases, 100% pass) | 2026-04-15 |
+
+### RFC-005: DB RCE Guard (CVE-2026-32622)
+
+**Impl Status**: Complete (v0.25); Tests green.
+
+**Changes**:
+- src/tools/db-guard.ts: sanitization + verify tool.
+- src/security/db-rce-detector.ts: sqlRisk, detectGoalHijack.
+- src/index.ts: Middleware + tool registration.
+- Docs: README/SECURITY.md updated.
+
+**DoD**: npm test passes; lint 0 errors; Manual PoC block (SQLBot vuln payload redacted).
 | CDK `docker buildx` hangs indefinitely | Docker resource contention or disk pressure on Apple Silicon Mac | Use manual Lambda deploy script (see below); fix Docker separately | 2026-03-24 |
 | `ENOSPC` on Claude Code startup | Mac disk full; `~/.claude/debug/` write fails | Free disk space; `rm -rf ~/.claude/debug/`; restart | 2026-03-24 |
 | 401 Unauthorized after `cdk deploy` | CDK does NOT automatically redeploy API Gateway stages when Lambda code or authorizer config changes | After every `cdk deploy`, run: `aws apigateway create-deployment --rest-api-id <api-id> --stage-name <stage>` | 2026-03-24 |
@@ -305,6 +318,12 @@ When a root cause is confirmed, add it here. Future sessions check this list fir
 | MCP server crashes on startup in claude.ai hosted environment or Claude Desktop | Top-level `export { handler } from './lambda-handler.js'` in index.ts causes AWS SDK instantiation (DynamoDBClient) in stdio mode; crashes in non-AWS environments | Remove top-level export from index.ts; Lambda deployments import from lambda-handler.ts directly (CDK stack already configured correctly) | 2026-03-28 |
 | MCP server exits ~300-400ms after `initialize` handshake from Claude Desktop | `startMcpServer()` returns after `server.connect()`, causing `main()` to complete. Node.js event loop empties and process exits. Manual stdin tests mask the issue because pipes keep event loop active. | Add `await new Promise(() => {})` at end of `startMcpServer()` to create infinite promise that prevents function from returning | 2026-03-30 |
 | `Cannot find package .../node_modules/fast-xml-parser/src/fxp.js` in MCPB bundle | `.mcpbignore` pattern `src/` (without leading `/`) matches ALL `src/` directories recursively, including inside `node_modules`. This strips source files from dependencies that store compiled JS in `src/` directories. | Change `.mcpbignore` pattern from `src/` to `/src/` (with leading `/`) to match ONLY root project's src directory. Pattern convention: leading `/` = root only, no leading `/` = matches anywhere. | 2026-03-31 |
+| OOM in ThreatDetector.test.ts | Large corpus (injection-corpus.ts, 10k+ lines) + jsdom DOM per test loaded at module init | Lazy-import corpus inside describe() blocks; batch patterns in groups of ~10 | 2026-04-12 |
+| @exodus/bytes nested ESM transform failure | reader.test.ts / token-metrics-integration.test.ts fail with ESM load error | @exodus/bytes loaded as nested dep under jsdom/node_modules/ — top-level transformIgnorePatterns lookahead doesn't match nested paths | Append |.*/@exodus/bytes/ to the alternation in jest.config.js — the .* wildcard catches any nesting depth — remove @exodus/bytes from the leading exception group if present | 2026-04-12 |
+| fetch-tool.test.ts ESM mock failure | mockResolvedValue is not a function | jest.mock() is hoisted at compile time and doesn't work with native ESM — static imports bypass the mock entirely | Replace all jest.mock() with jest.unstable_mockModule(); convert static imports of mocked modules to dynamic import() inside beforeAll() Rule: In ESM Jest, jest.unstable_mockModule() must be called BEFORE the dynamic import of the module under test | 2026-04-12 |
+| Multi-Turn / Stateful Attacks | Chaining where Page1 primes ("save URL:evil.com"), Page2 exfils ("use saved URL") | Stateless tools miss history priming | visus_context_scan tool scans history + local JSON cache for risks; HITL on score >0.7. Standalone; call manually before fetch. Covers 80% multi-turn (Unit 42 2026). | 2026-04-12 |
+
+| CVE-2026-4399: Boolean Bypass | Logic gates in prompts trigger restricted actions on true evaluation | Detected via boolean-gate-detector.ts (regex + safeEval); Middleware blocks high-risk args. Tests: boolean-gate.test.ts (10 cases). Risk Register R010. | 2026-04-15 |
 
 ---