visus-mcp 0.6.0 → 0.6.2

package/tests/elicit-runner.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Tests for Elicitation Runner
+ *
+ * Validates:
+ * - User accept/decline/cancel handling
+ * - Fail-safe behavior on errors
+ * - Threat report inclusion logic
+ */
+
+import { runElicitation } from '../src/sanitizer/elicit-runner.js';
+import type { ThreatReport } from '../src/sanitizer/threat-reporter.js';
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+
+describe('Elicitation Runner', () => {
+  let mockServer: jest.Mocked<Server>;
+
+  beforeEach(() => {
+    // Create a mock server with elicitInput method
+    mockServer = {
+      elicitInput: jest.fn()
+    } as any;
+  });
+
+  const createMockThreatReport = (): ThreatReport => ({
+    generated: new Date().toISOString(),
+    source_url: 'https://malicious.example.com',
+    overall_severity: 'CRITICAL',
+    total_findings: 5,
+    by_severity: { CRITICAL: 5, HIGH: 0, MEDIUM: 0, LOW: 0 },
+    pii_redacted: 0,
+    sanitization_applied: true,
+    frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+    findings_toon: 'findings[5]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized',
+    report_markdown: '# Report'
+  });
+
+  describe('User response handling', () => {
+    it('returns proceed:true when user accepts with proceed:true', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'accept',
+        content: {
+          proceed: true,
+          view_report: true
+        }
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+
+    it('returns proceed:false when user accepts with proceed:false', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'accept',
+        content: {
+          proceed: false,
+          view_report: true
+        }
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(false);
+      expect(result.includeReport).toBe(false); // Report not included when not proceeding
+    });
+
+    it('returns proceed:false on decline action', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'decline',
+        content: undefined
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(false);
+      expect(result.includeReport).toBe(false);
+    });
+
+    it('returns proceed:false on cancel action', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'cancel',
+        content: undefined
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(false);
+      expect(result.includeReport).toBe(false);
+    });
+
+    it('includes report when user checks view_report', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'accept',
+        content: {
+          proceed: true,
+          view_report: true
+        }
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+
+    it('excludes report when user unchecks view_report', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'accept',
+        content: {
+          proceed: true,
+          view_report: false
+        }
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(false);
+    });
+
+    it('defaults to including report when view_report is undefined', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'accept',
+        content: {
+          proceed: true
+        }
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+  });
+
+  describe('Fail-safe behavior', () => {
+    it('proceeds with sanitized content on elicitation error (fail-safe)', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockRejectedValue(
+        new Error('Elicitation not supported')
+      );
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+
+    it('proceeds with sanitized content on timeout (fail-safe)', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockRejectedValue(
+        new Error('Request timeout')
+      );
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+
+    it('proceeds with sanitized content on unknown action (fail-safe)', async () => {
+      const threatReport = createMockThreatReport();
+
+      mockServer.elicitInput.mockResolvedValue({
+        action: 'unknown_action' as any,
+        content: undefined
+      });
+
+      const result = await runElicitation(
+        mockServer,
+        threatReport,
+        'https://malicious.example.com'
+      );
+
+      expect(result.proceed).toBe(true);
+      expect(result.includeReport).toBe(true);
+    });
+  });
+});

package/tests/hitl-gate.test.ts

@@ -0,0 +1,267 @@
+/**
+ * Tests for HITL (Human-in-the-Loop) Gate
+ *
+ * Validates:
+ * - shouldElicit decision logic
+ * - buildElicitMessage formatting
+ * - ElicitSchema structure compliance
+ */
+
+import { shouldElicit, buildElicitMessage, ElicitSchema } from '../src/sanitizer/hitl-gate.js';
+import type { ThreatReport } from '../src/sanitizer/threat-reporter.js';
+
+describe('HITL Gate', () => {
+  describe('shouldElicit', () => {
+    it('returns true for CRITICAL severity report with findings', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 5,
+        by_severity: { CRITICAL: 5, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[5]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025,MS-2.3,AML.T0051.000,Content sanitized',
+        report_markdown: '# Report'
+      };
+
+      expect(shouldElicit(report)).toBe(true);
+    });
+
+    it('returns false for HIGH severity report', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://example.com',
+        overall_severity: 'HIGH',
+        total_findings: 3,
+        by_severity: { CRITICAL: 0, HIGH: 3, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: '',
+        report_markdown: ''
+      };
+
+      expect(shouldElicit(report)).toBe(false);
+    });
+
+    it('returns false for MEDIUM severity report', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://example.com',
+        overall_severity: 'MEDIUM',
+        total_findings: 2,
+        by_severity: { CRITICAL: 0, HIGH: 0, MEDIUM: 2, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: '',
+        report_markdown: ''
+      };
+
+      expect(shouldElicit(report)).toBe(false);
+    });
+
+    it('returns false for LOW severity report', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://example.com',
+        overall_severity: 'LOW',
+        total_findings: 1,
+        by_severity: { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 1 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: '',
+        report_markdown: ''
+      };
+
+      expect(shouldElicit(report)).toBe(false);
+    });
+
+    it('returns false for CLEAN report', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://example.com',
+        overall_severity: 'CLEAN',
+        total_findings: 0,
+        by_severity: { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: false,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: '',
+        report_markdown: ''
+      };
+
+      expect(shouldElicit(report)).toBe(false);
+    });
+
+    it('returns false for null report', () => {
+      expect(shouldElicit(null)).toBe(false);
+    });
+
+    it('returns false for CRITICAL severity with zero findings', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 0,
+        by_severity: { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: false,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: '',
+        report_markdown: ''
+      };
+
+      expect(shouldElicit(report)).toBe(false);
+    });
+  });
+
+  describe('buildElicitMessage', () => {
+    it('contains URL in output', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 2,
+        by_severity: { CRITICAL: 2, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[2]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized\n2,PI-002,system_prompt_leak,CRITICAL,0.90,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.001 - LLM Jailbreak,Content sanitized',
+        report_markdown: ''
+      };
+
+      const url = 'https://malicious.example.com';
+      const message = buildElicitMessage(report, url);
+
+      expect(message).toContain(url);
+    });
+
+    it('contains finding count', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 3,
+        by_severity: { CRITICAL: 3, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[3]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized',
+        report_markdown: ''
+      };
+
+      const message = buildElicitMessage(report, 'https://example.com');
+
+      expect(message).toContain('3');
+      expect(message).toContain('injection attempt(s)');
+    });
+
+    it('is under 300 characters', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 5,
+        by_severity: { CRITICAL: 5, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[5]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized',
+        report_markdown: ''
+      };
+
+      const message = buildElicitMessage(report, 'https://example.com');
+
+      expect(message.length).toBeLessThan(300);
+    });
+
+    it('contains top category', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 1,
+        by_severity: { CRITICAL: 1, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[1]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized',
+        report_markdown: ''
+      };
+
+      const message = buildElicitMessage(report, 'https://example.com');
+
+      expect(message).toContain('role_hijacking');
+    });
+
+    it('contains OWASP and MITRE identifiers', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 1,
+        by_severity: { CRITICAL: 1, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[1]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:\n1,PI-001,role_hijacking,CRITICAL,0.95,LLM01:2025 - Prompt Injection,MS-2.3,AML.T0051.000 - LLM Prompt Injection,Content sanitized',
+        report_markdown: ''
+      };
+
+      const message = buildElicitMessage(report, 'https://example.com');
+
+      expect(message).toContain('LLM01:2025');
+      expect(message).toContain('AML.T0051.000');
+    });
+
+    it('handles empty findings gracefully', () => {
+      const report: ThreatReport = {
+        generated: new Date().toISOString(),
+        source_url: 'https://malicious.example.com',
+        overall_severity: 'CRITICAL',
+        total_findings: 0,
+        by_severity: { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 },
+        pii_redacted: 0,
+        sanitization_applied: true,
+        frameworks: ['OWASP LLM Top 10', 'NIST AI 600-1', 'MITRE ATLAS'],
+        findings_toon: 'findings[0]{id,pattern_id,category,severity,confidence,owasp_llm,nist_ai_600_1,mitre_atlas,remediation}:',
+        report_markdown: ''
+      };
+
+      const message = buildElicitMessage(report, 'https://example.com');
+
+      expect(message).toContain('unknown');
+      expect(message).toContain('N/A');
+    });
+  });
+
+  describe('ElicitSchema', () => {
+    it('has flat primitive properties only', () => {
+      expect(ElicitSchema.type).toBe('object');
+      expect(ElicitSchema.properties.proceed.type).toBe('boolean');
+      expect(ElicitSchema.properties.view_report.type).toBe('boolean');
+
+      // Verify no nested objects
+      const proceedProp = ElicitSchema.properties.proceed;
+      const viewReportProp = ElicitSchema.properties.view_report;
+
+      expect(typeof proceedProp.type).toBe('string');
+      expect(typeof viewReportProp.type).toBe('string');
+    });
+
+    it('has required array containing proceed', () => {
+      expect(ElicitSchema.required).toContain('proceed');
+    });
+
+    it('has descriptive titles and descriptions', () => {
+      expect(ElicitSchema.properties.proceed.title).toBeTruthy();
+      expect(ElicitSchema.properties.proceed.description).toBeTruthy();
+      expect(ElicitSchema.properties.view_report.title).toBeTruthy();
+      expect(ElicitSchema.properties.view_report.description).toBeTruthy();
+    });
+  });
+});

package/tests/threat-reporter.test.ts

@@ -134,7 +134,7 @@ describe('Threat Reporter', () => {
       }
     });
 
-    it('should include all three frameworks', () => {
+    it('should include all four frameworks', () => {
       const result = generateThreatReport({
         patterns_detected: ['role_hijacking'],
         pii_redacted: 0,
@@ -146,6 +146,7 @@ describe('Threat Reporter', () => {
         expect(result.frameworks).toContain('OWASP LLM Top 10');
         expect(result.frameworks).toContain('NIST AI 600-1');
         expect(result.frameworks).toContain('MITRE ATLAS');
+        expect(result.frameworks).toContain('ISO/IEC 42001');
       }
     });
 
@@ -247,6 +248,7 @@ describe('Threat Reporter', () => {
       expect(mappings.owasp_llm).toContain('LLM01:2025');
       expect(mappings.nist_ai_600_1).toContain('MS-2.5');
       expect(mappings.mitre_atlas).toContain('AML.T0051');
+      expect(mappings.iso_42001).toBe('A.6.1.5 - AI System Security (Adversarial Input)');
     });
 
     it('should map data_exfiltration to correct frameworks', () => {
@@ -254,6 +256,7 @@ describe('Threat Reporter', () => {
       expect(mappings.owasp_llm).toContain('LLM02:2025');
       expect(mappings.nist_ai_600_1).toContain('MS-2.6');
       expect(mappings.mitre_atlas).toContain('AML.T0048');
+      expect(mappings.iso_42001).toContain('A.7.5');
     });
 
     it('should return default mappings for unknown pattern', () => {
@@ -261,6 +264,71 @@ describe('Threat Reporter', () => {
       expect(mappings.owasp_llm).toContain('LLM01:2025');
       expect(mappings.nist_ai_600_1).toContain('MS-2.5');
       expect(mappings.mitre_atlas).toContain('AML.T0051');
+      expect(mappings.iso_42001).toBe('A.6.1.5 - AI System Security');
+    });
+
+    it('should have ISO 42001 mapping for all 43 patterns', () => {
+      // List of all 43 patterns from injection corpus
+      const allPatterns = [
+        'direct_instruction_injection', 'role_hijacking', 'system_prompt_extraction',
+        'privilege_escalation', 'context_poisoning', 'data_exfiltration',
+        'base64_obfuscation', 'unicode_lookalikes', 'zero_width_characters',
+        'html_script_injection', 'data_uri_injection', 'markdown_link_injection',
+        'url_fragment_hashjack', 'social_engineering_urgency', 'instruction_delimiter_injection',
+        'multi_language_obfuscation', 'reverse_text_obfuscation', 'leetspeak_obfuscation',
+        'jailbreak_keywords', 'token_smuggling', 'system_message_injection',
+        'conversation_reset', 'memory_manipulation', 'capability_probing',
+        'chain_of_thought_manipulation', 'hypothetical_scenario_injection', 'ethical_override',
+        'output_format_manipulation', 'negative_instruction', 'credential_harvesting',
+        'time_based_triggers', 'code_execution_requests', 'file_system_access',
+        'training_data_extraction', 'simulator_mode', 'nested_encoding',
+        'payload_splitting', 'css_hiding', 'authority_impersonation',
+        'testing_debugging_claims', 'callback_url_injection', 'whitespace_steganography',
+        'comment_injection'
+      ];
+
+      for (const pattern of allPatterns) {
+        const mappings = getFrameworkMappings(pattern);
+        expect(mappings.iso_42001).toBeTruthy();
+        expect(mappings.iso_42001.length).toBeGreaterThan(0);
+        expect(mappings.iso_42001).toMatch(/^A\.\d+/); // Should start with A.X (Annex A format)
+      }
+    });
+
+    it('should include ISO 42001 column in Markdown report', () => {
+      const result = generateThreatReport({
+        patterns_detected: ['role_hijacking'],
+        pii_redacted: 0,
+        source_url: 'https://test.example.com'
+      });
+
+      expect(result).not.toBeNull();
+      if (result) {
+        const md = result.report_markdown;
+        expect(md).toContain('ISO 42001');
+        expect(md).toContain('ISO/IEC 42001');
+      }
+    });
+
+    it('should have 10 fields in TOON header', () => {
+      const result = generateThreatReport({
+        patterns_detected: ['role_hijacking'],
+        pii_redacted: 0,
+        source_url: 'https://test.example.com'
+      });
+
+      expect(result).not.toBeNull();
+      if (result) {
+        const toon = result.findings_toon;
+        // TOON header should have 10 fields: id, pattern_id, category, severity, confidence, owasp_llm, nist_ai_600_1, mitre_atlas, iso_42001, remediation
+        expect(toon).toMatch(/findings\[\d+\]\{[^}]+\}/);
+        const headerMatch = toon.match(/findings\[\d+\]\{([^}]+)\}/);
+        if (headerMatch) {
+          const fields = headerMatch[1].split(',');
+          expect(fields.length).toBe(10);
+          expect(fields).toContain('iso_42001');
+        }
+      }
     });
   });
 });