visus-mcp 0.2.0 → 0.6.0

package/src/index.ts

@@ -27,6 +27,8 @@ import {
 
 import { visusFetch, visusFetchToolDefinition } from './tools/fetch.js';
 import { visusFetchStructured, visusFetchStructuredToolDefinition } from './tools/fetch-structured.js';
+import { visusRead, visusReadToolDefinition } from './tools/read.js';
+import { visusSearch, visusSearchToolDefinition } from './tools/search.js';
 import { closeBrowser } from './browser/playwright-renderer.js';
 import { detectRuntime, logRuntimeConfig, validateRuntime } from './runtime.js';
 
@@ -52,7 +54,9 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
   return {
     tools: [
       visusFetchToolDefinition,
-      visusFetchStructuredToolDefinition
+      visusFetchStructuredToolDefinition,
+      visusReadToolDefinition,
+      visusSearchToolDefinition
     ]
   };
 });
@@ -105,6 +109,46 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
+      case 'visus_read': {
+        const result = await visusRead(args as any);
+
+        if (!result.ok) {
+          throw new McpError(
+            ErrorCode.InternalError,
+            `visus_read failed: ${result.error.message}`
+          );
+        }
+
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify(result.value, null, 2)
+            }
+          ]
+        };
+      }
+
+      case 'visus_search': {
+        const result = await visusSearch(args as any);
+
+        if (!result.ok) {
+          throw new McpError(
+            ErrorCode.InternalError,
+            `visus_search failed: ${result.error.message}`
+          );
+        }
+
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify(result.value, null, 2)
+            }
+          ]
+        };
+      }
+
       default:
         throw new McpError(
           ErrorCode.MethodNotFound,
@@ -138,7 +182,7 @@ async function startMcpServer() {
     event: 'mcp_server_started',
     name: 'visus-mcp',
     version: '0.2.0',
-    tools: ['visus_fetch', 'visus_fetch_structured']
+    tools: ['visus_fetch', 'visus_fetch_structured', 'visus_read', 'visus_search']
   }));
 
   // Graceful shutdown
@@ -188,9 +232,9 @@ async function main() {
   }
 }
 
-// Export Lambda handlers (for AWS deployment)
-// These are only used when the file is imported as a module by Lambda runtime
-export { handler, healthCheck } from './lambda-handler.js';
+// Export Lambda handler (for AWS deployment)
+// This is only used when the file is imported as a module by Lambda runtime
+export { handler } from './lambda-handler.js';
 
 // Run stdio MCP server when executed directly (not in Lambda)
 if (!process.env.AWS_LAMBDA_FUNCTION_NAME) {

package/src/lambda-handler.ts

@@ -14,10 +14,16 @@
  */
 
 import type { APIGatewayProxyEvent, APIGatewayProxyResult, Context } from 'aws-lambda';
+import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
+import { DynamoDBDocumentClient, PutCommand } from '@aws-sdk/lib-dynamodb';
 import { visusFetch } from './tools/fetch.js';
 import { visusFetchStructured } from './tools/fetch-structured.js';
 import { closeBrowser } from './browser/playwright-renderer.js';
 
+// Initialize DynamoDB client
+const ddbClient = new DynamoDBClient({});
+const docClient = DynamoDBDocumentClient.from(ddbClient);
+
 /**
  * API request body for visus_fetch
  */
@@ -36,6 +42,63 @@ interface FetchStructuredRequest {
   timeout_ms?: number;
 }
 
+/**
+ * Fire-and-forget audit logging to DynamoDB
+ *
+ * Logs request metadata without blocking the response.
+ * Errors are logged but do not affect the API response.
+ *
+ * @param userId User ID from Cognito JWT
+ * @param requestId AWS request ID
+ * @param url URL being fetched
+ * @param endpoint API endpoint (/fetch or /fetch-structured)
+ * @param patternsDetected Sanitization patterns detected
+ * @param piiRedacted PII types redacted
+ */
+function logAuditEvent(
+  userId: string,
+  requestId: string,
+  url: string,
+  endpoint: string,
+  patternsDetected: string[],
+  piiRedacted: string[]
+): void {
+  const tableName = process.env.AUDIT_TABLE_NAME;
+
+  if (!tableName) {
+    console.error('AUDIT_TABLE_NAME not set - skipping audit logging');
+    return;
+  }
+
+  const now = new Date();
+  const ttl = Math.floor(now.getTime() / 1000) + (30 * 24 * 60 * 60); // 30 days from now
+
+  const item = {
+    user_id: userId,
+    timestamp: now.toISOString(),
+    request_id: requestId,
+    url,
+    endpoint,
+    patterns_detected: patternsDetected,
+    pii_redacted: piiRedacted,
+    ttl, // Auto-delete after 30 days
+  };
+
+  // Fire-and-forget: do not await
+  docClient.send(new PutCommand({
+    TableName: tableName,
+    Item: item,
+  })).catch((error: unknown) => {
+    // Log error but do not throw (fire-and-forget pattern)
+    console.error(JSON.stringify({
+      timestamp: now.toISOString(),
+      event: 'audit_logging_failed',
+      error: error instanceof Error ? error.message : String(error),
+      request_id: requestId,
+    }));
+  });
+}
+
 /**
  * Lambda handler for Visus API
  *
@@ -65,10 +128,14 @@ export async function handler(
   }));
 
   try {
-    // CORS headers for all responses
+    // CORS headers for all responses (environment-variable-driven allowlist)
+    const allowedOrigins = (process.env.ALLOWED_ORIGINS || '*').split(',');
+    const origin = event.headers.origin || event.headers.Origin || '';
+    const allowOrigin = allowedOrigins.includes(origin) ? origin : allowedOrigins[0] || '*';
+
     const corsHeaders = {
-      'Access-Control-Allow-Origin': '*', // Phase 2: Open. Phase 3: Restrict to Lateos domains
-      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Origin': allowOrigin,
+      'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
       'Access-Control-Allow-Headers': 'Content-Type, Authorization',
       'Content-Type': 'application/json',
     };
@@ -82,7 +149,22 @@ export async function handler(
       };
     }
 
-    // Only allow POST requests
+    // Health check endpoint (no auth required, allows GET and POST)
+    // SECURITY FIX (FINDING 2): Moved before POST-only validation to support standard GET health checks
+    if (event.path === '/health' || event.path === '/dev/health' || event.path === '/prod/health') {
+      return {
+        statusCode: 200,
+        headers: corsHeaders,
+        body: JSON.stringify({
+          status: 'healthy',
+          service: 'visus-mcp',
+          version: '0.3.1',
+          timestamp: new Date().toISOString(),
+        }),
+      };
+    }
+
+    // Only allow POST requests for protected endpoints
     if (event.httpMethod !== 'POST') {
       return {
         statusCode: 405,
@@ -103,8 +185,31 @@ export async function handler(
       };
     }
 
+    // SECURITY FIX (FINDING 1): Application-level authentication enforcement
+    // Extract user ID from Cognito authorizer
+    const userId = event.requestContext.authorizer?.claims?.sub;
+
+    // Require authentication for all protected endpoints (not already handled above)
+    if (!userId) {
+      console.error(JSON.stringify({
+        timestamp: new Date().toISOString(),
+        event: 'auth_required',
+        request_id: requestId,
+        path: event.path,
+        reason: 'Missing Cognito authorizer context - Lambda must be invoked via API Gateway',
+      }));
+
+      return {
+        statusCode: 401,
+        headers: corsHeaders,
+        body: JSON.stringify({
+          error: 'Unauthorized: Authentication required. This Lambda must be invoked via API Gateway with Cognito authorizer.',
+        }),
+      };
+    }
+
     // Route based on path
-    if (event.path === '/fetch' || event.path === '/prod/fetch') {
+    if (event.path === '/fetch' || event.path === '/dev/fetch' || event.path === '/prod/fetch') {
       const fetchReq = body as FetchRequest;
 
       // Validate request
@@ -127,6 +232,16 @@ export async function handler(
         };
       }
 
+      // Fire-and-forget audit logging
+      logAuditEvent(
+        userId,
+        requestId,
+        fetchReq.url,
+        '/fetch',
+        result.value.sanitization.patterns_detected,
+        result.value.sanitization.pii_types_redacted
+      );
+
       return {
         statusCode: 200,
         headers: corsHeaders,
@@ -134,7 +249,7 @@ export async function handler(
       };
     }
 
-    if (event.path === '/fetch-structured' || event.path === '/prod/fetch-structured') {
+    if (event.path === '/fetch-structured' || event.path === '/dev/fetch-structured' || event.path === '/prod/fetch-structured') {
       const fetchReq = body as FetchStructuredRequest;
 
       // Validate request
@@ -165,6 +280,16 @@ export async function handler(
         };
       }
 
+      // Fire-and-forget audit logging
+      logAuditEvent(
+        userId,
+        requestId,
+        fetchReq.url,
+        '/fetch-structured',
+        result.value.sanitization.patterns_detected,
+        result.value.sanitization.pii_types_redacted
+      );
+
       return {
         statusCode: 200,
         headers: corsHeaders,
@@ -203,23 +328,3 @@ export async function handler(
     await closeBrowser();
   }
 }
-
-/**
- * Health check handler
- *
- * @returns API Gateway response
- */
-export async function healthCheck(): Promise<APIGatewayProxyResult> {
-  return {
-    statusCode: 200,
-    headers: {
-      'Content-Type': 'application/json',
-    },
-    body: JSON.stringify({
-      status: 'healthy',
-      service: 'visus-mcp',
-      version: '0.2.0',
-      timestamp: new Date().toISOString(),
-    }),
-  };
-}

package/src/sanitizer/framework-mapper.ts

@@ -0,0 +1,347 @@
+/**
+ * Compliance Framework Mapper
+ *
+ * Maps injection pattern categories to compliance framework identifiers:
+ * - OWASP LLM Top 10 (2025)
+ * - NIST AI 600-1 (Generative AI Profile)
+ * - MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
+ */
+
+export interface FrameworkMappings {
+  owasp_llm: string;
+  nist_ai_600_1: string;
+  mitre_atlas: string;
+}
+
+/**
+ * Pattern category to framework mapping
+ */
+const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
+  // Direct instruction injection
+  direct_instruction_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Role hijacking
+  role_hijacking: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // System prompt extraction
+  system_prompt_extraction: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Privilege escalation
+  privilege_escalation: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Context poisoning
+  context_poisoning: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Data exfiltration
+  data_exfiltration: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Encoding obfuscation
+  base64_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Unicode lookalikes
+  unicode_lookalikes: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Zero-width characters
+  zero_width_characters: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // HTML script injection
+  html_script_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Data URI injection
+  data_uri_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Markdown link injection
+  markdown_link_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // URL fragment attacks
+  url_fragment_hashjack: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Social engineering
+  social_engineering_urgency: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Instruction delimiter injection
+  instruction_delimiter_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Multi-language obfuscation
+  multi_language_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Reverse text obfuscation
+  reverse_text_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Leetspeak obfuscation
+  leetspeak_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Jailbreak keywords
+  jailbreak_keywords: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Token smuggling
+  token_smuggling: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // System message injection
+  system_message_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Conversation reset
+  conversation_reset: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Memory manipulation
+  memory_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Capability probing
+  capability_probing: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Chain-of-thought manipulation
+  chain_of_thought_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Hypothetical scenario injection
+  hypothetical_scenario_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Ethical override
+  ethical_override: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Output format manipulation
+  output_format_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Negative instruction
+  negative_instruction: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Credential harvesting
+  credential_harvesting: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Time-based triggers
+  time_based_triggers: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Code execution requests
+  code_execution_requests: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // File system access
+  file_system_access: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Training data extraction
+  training_data_extraction: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Simulator mode
+  simulator_mode: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Nested encoding
+  nested_encoding: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Payload splitting
+  payload_splitting: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // CSS-based hiding
+  css_hiding: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Authority impersonation
+  authority_impersonation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Testing/debugging claims
+  testing_debugging_claims: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Callback URL injection
+  callback_url_injection: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Whitespace steganography
+  whitespace_steganography: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Comment injection
+  comment_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  }
+};
+
+/**
+ * Default mapping for unknown pattern categories
+ */
+const DEFAULT_MAPPINGS: FrameworkMappings = {
+  owasp_llm: 'LLM01:2025 - Prompt Injection',
+  nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+  mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+};
+
+/**
+ * Get framework mappings for a pattern category
+ */
+export function getFrameworkMappings(patternCategory: string): FrameworkMappings {
+  return FRAMEWORK_MAP[patternCategory] || DEFAULT_MAPPINGS;
+}
+
+/**
+ * Get all supported frameworks
+ */
+export function getSupportedFrameworks(): string[] {
+  return [
+    'OWASP LLM Top 10 (2025)',
+    'NIST AI 600-1 (Generative AI Profile)',
+    'MITRE ATLAS (Adversarial Threat Landscape)'
+  ];
+}