visus-mcp 0.3.0 → 0.6.0

package/src/sanitizer/framework-mapper.ts

@@ -0,0 +1,347 @@
+/**
+ * Compliance Framework Mapper
+ *
+ * Maps injection pattern categories to compliance framework identifiers:
+ * - OWASP LLM Top 10 (2025)
+ * - NIST AI 600-1 (Generative AI Profile)
+ * - MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
+ */
+
+export interface FrameworkMappings {
+  owasp_llm: string;
+  nist_ai_600_1: string;
+  mitre_atlas: string;
+}
+
+/**
+ * Pattern category to framework mapping
+ */
+const FRAMEWORK_MAP: Record<string, FrameworkMappings> = {
+  // Direct instruction injection
+  direct_instruction_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Role hijacking
+  role_hijacking: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // System prompt extraction
+  system_prompt_extraction: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Privilege escalation
+  privilege_escalation: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Context poisoning
+  context_poisoning: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Data exfiltration
+  data_exfiltration: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Encoding obfuscation
+  base64_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Unicode lookalikes
+  unicode_lookalikes: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Zero-width characters
+  zero_width_characters: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // HTML script injection
+  html_script_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Data URI injection
+  data_uri_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Markdown link injection
+  markdown_link_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // URL fragment attacks
+  url_fragment_hashjack: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Social engineering
+  social_engineering_urgency: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Instruction delimiter injection
+  instruction_delimiter_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Multi-language obfuscation
+  multi_language_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Reverse text obfuscation
+  reverse_text_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Leetspeak obfuscation
+  leetspeak_obfuscation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Jailbreak keywords
+  jailbreak_keywords: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Token smuggling
+  token_smuggling: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // System message injection
+  system_message_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Conversation reset
+  conversation_reset: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Memory manipulation
+  memory_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Capability probing
+  capability_probing: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Chain-of-thought manipulation
+  chain_of_thought_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Hypothetical scenario injection
+  hypothetical_scenario_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Ethical override
+  ethical_override: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Output format manipulation
+  output_format_manipulation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Negative instruction
+  negative_instruction: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Credential harvesting
+  credential_harvesting: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Time-based triggers
+  time_based_triggers: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Code execution requests
+  code_execution_requests: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // File system access
+  file_system_access: {
+    owasp_llm: 'LLM08:2025 - Excessive Agency',
+    nist_ai_600_1: 'GV-1.1 - Policies and Procedures',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Training data extraction
+  training_data_extraction: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Simulator mode
+  simulator_mode: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Nested encoding
+  nested_encoding: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Payload splitting
+  payload_splitting: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // CSS-based hiding
+  css_hiding: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Authority impersonation
+  authority_impersonation: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Testing/debugging claims
+  testing_debugging_claims: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+  },
+
+  // Callback URL injection
+  callback_url_injection: {
+    owasp_llm: 'LLM02:2025 - Sensitive Information Disclosure',
+    nist_ai_600_1: 'MS-2.6 - Data Disclosure',
+    mitre_atlas: 'AML.T0048 - External Harms'
+  },
+
+  // Whitespace steganography
+  whitespace_steganography: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  },
+
+  // Comment injection
+  comment_injection: {
+    owasp_llm: 'LLM01:2025 - Prompt Injection',
+    nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+    mitre_atlas: 'AML.T0051.001 - LLM Prompt Injection: Indirect'
+  }
+};
+
+/**
+ * Default mapping for unknown pattern categories
+ */
+const DEFAULT_MAPPINGS: FrameworkMappings = {
+  owasp_llm: 'LLM01:2025 - Prompt Injection',
+  nist_ai_600_1: 'MS-2.5 - Prompt Injection',
+  mitre_atlas: 'AML.T0051.000 - LLM Prompt Injection'
+};
+
+/**
+ * Get framework mappings for a pattern category
+ */
+export function getFrameworkMappings(patternCategory: string): FrameworkMappings {
+  return FRAMEWORK_MAP[patternCategory] || DEFAULT_MAPPINGS;
+}
+
+/**
+ * Get all supported frameworks
+ */
+export function getSupportedFrameworks(): string[] {
+  return [
+    'OWASP LLM Top 10 (2025)',
+    'NIST AI 600-1 (Generative AI Profile)',
+    'MITRE ATLAS (Adversarial Threat Landscape)'
+  ];
+}

package/src/sanitizer/index.ts

@@ -10,6 +10,7 @@
 
 import { detectAndNeutralize, getSeverityScore, hasCriticalThreats } from './injection-detector.js';
 import { redactPII } from './pii-redactor.js';
+import { generateThreatReport, type ThreatReport } from './threat-reporter.js';
 
 export interface SanitizationResult {
   content: string;
@@ -31,6 +32,7 @@ export interface SanitizationResult {
       low: number;
     };
   };
+  threat_report?: ThreatReport;
 }
 
 /**
@@ -71,7 +73,15 @@ export function sanitize(content: string, sourceUrl?: string): SanitizationResul
     content_modified: contentModified
   });
 
-  return {
+  // Step 4: Generate threat report (only if findings exist)
+  const threatReport = generateThreatReport({
+    patterns_detected: injectionResult.patterns_detected,
+    pii_redacted: piiResult.pii_types_redacted.length,
+    source_url: sourceUrl || 'unknown',
+    detections_by_severity: injectionResult.metadata.detections_by_severity
+  });
+
+  const result: SanitizationResult = {
     content: finalContent,
     sanitization: {
       patterns_detected: injectionResult.patterns_detected,
@@ -87,6 +97,13 @@ export function sanitize(content: string, sourceUrl?: string): SanitizationResul
       detections_by_severity: injectionResult.metadata.detections_by_severity
     }
   };
+
+  // Include threat_report only if findings exist
+  if (threatReport) {
+    result.threat_report = threatReport;
+  }
+
+  return result;
 }
 
 /**

package/src/sanitizer/patterns.ts

@@ -313,7 +313,7 @@ export const INJECTION_PATTERNS: InjectionPattern[] = [
   {
     name: 'code_execution_requests',
     description: 'Requests code execution or contains dangerous code patterns',
-    regex: /\b(execute|run\s+the\s+following|eval\(|exec\(|os\.system|subprocess|__import__|shell\s+command|bash\s+-c)\b/gi,
+    regex: /\b(execute(?!-api\.)|run\s+the\s+following|eval\(|exec\(|os\.system|subprocess|__import__|shell\s+command|bash\s+-c)\b/gi,
     severity: 'high',
     action: 'redact'
   },

package/src/sanitizer/severity-classifier.ts

@@ -0,0 +1,132 @@
+/**
+ * Severity Classification Engine
+ *
+ * Maps injection pattern categories to standardized severity levels.
+ * Used for threat reporting and compliance documentation.
+ */
+
+export type Severity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+export type OverallSeverity = Severity | 'CLEAN';
+
+/**
+ * Pattern category to severity mapping
+ * Aligned with NIST AI 600-1 and OWASP LLM Top 10 risk levels
+ */
+const SEVERITY_MAP: Record<string, Severity> = {
+  // CRITICAL - Immediate threat, block-level
+  direct_instruction_injection: 'CRITICAL',
+  role_hijacking: 'CRITICAL',
+  system_prompt_extraction: 'CRITICAL',
+  privilege_escalation: 'CRITICAL',
+  data_exfiltration: 'CRITICAL',
+  code_execution_requests: 'CRITICAL',
+  memory_manipulation: 'CRITICAL',
+  jailbreak_keywords: 'CRITICAL',
+  ethical_override: 'CRITICAL',
+  credential_harvesting: 'CRITICAL',
+  html_script_injection: 'CRITICAL',
+
+  // HIGH - Significant threat
+  context_poisoning: 'HIGH',
+  base64_obfuscation: 'HIGH',
+  zero_width_characters: 'HIGH',
+  data_uri_injection: 'HIGH',
+  markdown_link_injection: 'HIGH',
+  instruction_delimiter_injection: 'HIGH',
+  token_smuggling: 'HIGH',
+  system_message_injection: 'HIGH',
+  file_system_access: 'HIGH',
+  training_data_extraction: 'HIGH',
+  nested_encoding: 'HIGH',
+  authority_impersonation: 'HIGH',
+  callback_url_injection: 'HIGH',
+
+  // MEDIUM - Moderate threat
+  comment_injection: 'MEDIUM',
+  unicode_lookalikes: 'MEDIUM',
+  url_fragment_hashjack: 'MEDIUM',
+  social_engineering_urgency: 'MEDIUM',
+  multi_language_obfuscation: 'MEDIUM',
+  reverse_text_obfuscation: 'MEDIUM',
+  conversation_reset: 'MEDIUM',
+  chain_of_thought_manipulation: 'MEDIUM',
+  hypothetical_scenario_injection: 'MEDIUM',
+  output_format_manipulation: 'MEDIUM',
+  simulator_mode: 'MEDIUM',
+  payload_splitting: 'MEDIUM',
+  css_hiding: 'MEDIUM',
+  testing_debugging_claims: 'MEDIUM',
+
+  // LOW - Low threat, flagged for awareness
+  leetspeak_obfuscation: 'LOW',
+  capability_probing: 'LOW',
+  negative_instruction: 'LOW',
+  time_based_triggers: 'LOW',
+  whitespace_steganography: 'LOW'
+};
+
+/**
+ * Classify severity for a single pattern category
+ */
+export function classifySeverity(patternCategory: string): Severity {
+  return SEVERITY_MAP[patternCategory] || 'LOW';
+}
+
+/**
+ * Interface for a threat finding
+ */
+export interface Finding {
+  pattern_category: string;
+  severity: Severity;
+}
+
+/**
+ * Aggregate severity across multiple findings
+ * Returns the highest severity level found, or CLEAN if no findings
+ */
+export function aggregateSeverity(findings: Finding[]): OverallSeverity {
+  if (findings.length === 0) {
+    return 'CLEAN';
+  }
+
+  const severities = findings.map(f => f.severity);
+
+  if (severities.includes('CRITICAL')) return 'CRITICAL';
+  if (severities.includes('HIGH')) return 'HIGH';
+  if (severities.includes('MEDIUM')) return 'MEDIUM';
+  if (severities.includes('LOW')) return 'LOW';
+
+  return 'CLEAN';
+}
+
+/**
+ * Count findings by severity level
+ */
+export function countBySeverity(findings: Finding[]): Record<Severity, number> {
+  const counts: Record<Severity, number> = {
+    CRITICAL: 0,
+    HIGH: 0,
+    MEDIUM: 0,
+    LOW: 0
+  };
+
+  for (const finding of findings) {
+    counts[finding.severity]++;
+  }
+
+  return counts;
+}
+
+/**
+ * Get emoji for severity level (for Markdown reports)
+ */
+export function getSeverityEmoji(severity: Severity | OverallSeverity): string {
+  switch (severity) {
+    case 'CRITICAL': return '🔴';
+    case 'HIGH': return '🟠';
+    case 'MEDIUM': return '🟡';
+    case 'LOW': return '🟢';
+    case 'CLEAN': return '✅';
+    default: return '⚪';
+  }
+}