iris-security-mcp 0.2.5__py3-none-any.whl

iris_mcp/__init__.py

@@ -0,0 +1,3 @@
+"""IRIS MCP Server — Claude-accessible AI agent governance."""
+
+__version__ = "0.2.5"

iris_mcp/prompts/__init__.py

@@ -0,0 +1 @@
+"""IRIS MCP prompt templates."""

iris_mcp/prompts/system.py

@@ -0,0 +1,36 @@
+"""System prompts for IRIS MCP."""
+
+IRIS_SYSTEM_PROMPT = """
+You have access to IRIS — an AI agent governance platform.
+IRIS helps developers declare what their AI agents are allowed
+to do and enforces those policies at runtime.
+
+When a developer asks about AI compliance, regulations, or
+governing their agents, use IRIS tools to give them accurate,
+real-time answers based on their actual codebase and agents.
+
+Key IRIS concepts:
+- AgentPassport: the agent's identity and compliance declaration
+- Cedar policy: formally verified policy compiled from plain English
+- Evidence Vault: tamper-evident audit trail of every decision
+- HITL: human-in-the-loop approval for sensitive actions
+
+Available frameworks (free):
+- colorado-ai-act: Colorado SB 26-189 (effective Jan 1, 2027)
+- ccpa-admt: California ADMT regulations (effective Jan 1, 2026)
+- colorado-chatbot: Colorado HB 1263 (effective Jan 1, 2027)
+- colorado-health-ai: Colorado HB 1139 (effective Jan 1, 2027)
+- colorado-mental-health: Colorado HB 1195 (effective Aug 12, 2026)
+- nyc-ll144: NYC Local Law 144 — AI in hiring (active now)
+- illinois-ai-video: Illinois AI Video Interview Act (active now)
+
+Available frameworks (Pro):
+- nist-ai-rmf, fedramp-moderate, hipaa, soc2, gdpr, eu-ai-act,
+  china-pipl, hr-ai
+
+When a developer asks which regulations apply to their agent,
+call iris_framework_suggest with what you know about their agent.
+
+When a Pro feature is needed but license is not active, explain
+what the feature does and how to activate: iris license activate
+""".strip()

iris_mcp/resources/__init__.py

@@ -0,0 +1 @@
+"""IRIS MCP resources."""

iris_mcp/resources/frameworks.py

@@ -0,0 +1,88 @@
+"""Compliance framework documentation as MCP resources."""
+
+from __future__ import annotations
+
+from mcp.types import Resource
+
+from iris_core.compliance.framework_check import load_bundle_data
+from iris_core.compliance.registry import _BUNDLE_LOADERS, _is_paid_bundle
+
+_FRAMEWORK_NAMES = {
+    "colorado-ai-act": "Colorado AI Act (SB 26-189)",
+    "colorado-chatbot": "Colorado Chatbot Act (HB 1263)",
+    "colorado-health-ai": "Colorado Health AI (HB 1139)",
+    "colorado-mental-health-ai": "Colorado Mental Health AI (HB 1195)",
+    "ccpa-admt": "California CCPA/ADMT",
+    "china-pipl": "China PIPL",
+    "illinois-ai-video": "Illinois AI Video Interview Act",
+    "nyc-ll144": "NYC Local Law 144 — AEDTs",
+    "hipaa": "HIPAA",
+    "soc2": "SOC 2",
+    "gdpr": "GDPR",
+    "eu-ai-act": "EU AI Act",
+    "nist-ai-rmf": "NIST AI RMF",
+    "fedramp": "FedRAMP Moderate",
+}
+
+
+def _load_bundle_metadata(bundle_id: str) -> dict:
+    """Load bundle docs without Pro entitlement gating (discovery/docs only)."""
+    return load_bundle_data(bundle_id)
+
+
+def _framework_markdown(bundle_id: str, rules: dict) -> str:
+    name = rules.get("full_name") or _FRAMEWORK_NAMES.get(bundle_id, bundle_id)
+    tier = "Pro" if _is_paid_bundle(bundle_id) else "Free"
+    lines = [
+        f"# {name}",
+        "",
+        f"**Bundle ID:** `{bundle_id}`",
+        f"**Tier:** {tier}",
+        f"**Jurisdiction:** {rules.get('jurisdiction', 'See bundle')}",
+        f"**Effective date:** {rules.get('effective_date', 'See bundle')}",
+        "",
+        "## IRIS coverage",
+        "",
+    ]
+    if rules.get("warning"):
+        lines.extend([f"> {rules['warning']}", ""])
+    lines.append("## Rules")
+    lines.append("")
+    for rule in rules.get("rules", []):
+        lines.append(f"### {rule.get('rule_id')} — {rule.get('name')}")
+        lines.append(f"- **Severity:** {rule.get('severity')}")
+        lines.append(f"- {rule.get('description', '')}")
+        if rule.get("how_iris_satisfies"):
+            lines.append(f"- **IRIS control:** {rule['how_iris_satisfies']}")
+        lines.append("")
+    return "\n".join(lines)
+
+
+def build_framework_resources() -> list[Resource]:
+    resources: list[Resource] = []
+    for bundle_id in sorted(_BUNDLE_LOADERS):
+        rules = _load_bundle_metadata(bundle_id)
+        name = rules.get("full_name") or _FRAMEWORK_NAMES.get(bundle_id, bundle_id)
+        resources.append(
+            Resource(
+                uri=f"iris://frameworks/{bundle_id}",
+                name=name,
+                description="Rules, effective dates, and IRIS coverage",
+                mimeType="text/markdown",
+            )
+        )
+    return resources
+
+
+FRAMEWORK_RESOURCES = build_framework_resources()
+_FRAMEWORK_TEXT: dict[str, str] = {}
+
+
+def get_framework_text(uri: str) -> str | None:
+    if not _FRAMEWORK_TEXT:
+        for bundle_id in _BUNDLE_LOADERS:
+            rules = _load_bundle_metadata(bundle_id)
+            _FRAMEWORK_TEXT[f"iris://frameworks/{bundle_id}"] = _framework_markdown(
+                bundle_id, rules
+            )
+    return _FRAMEWORK_TEXT.get(uri)

iris_mcp/server.py

@@ -0,0 +1,237 @@
+"""IRIS MCP Server — connect Claude Desktop and Cursor to AI governance."""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import sys
+
+from mcp.server import Server
+from mcp.server.stdio import stdio_server
+from mcp.types import GetPromptResult, Prompt, PromptMessage, Resource, TextContent, TextResourceContents
+
+from iris_core.entitlements import Entitlements, Feature
+from iris_mcp import __version__
+from iris_mcp.prompts.system import IRIS_SYSTEM_PROMPT
+from iris_mcp.resources.frameworks import FRAMEWORK_RESOURCES, get_framework_text
+from iris_mcp.tools import (
+    compliance,
+    cost,
+    discovery,
+    evidence,
+    governance,
+    hitl,
+    monitoring,
+    regulatory,
+)
+
+app = Server("iris-governance")
+
+
+def collect_tools(*, include_pro: bool | None = None) -> list:
+    if include_pro is None:
+        include_pro = Entitlements().has(Feature.BUNDLE_HIPAA)
+
+    tools = []
+    tools.extend(discovery.get_tools())
+    tools.extend(compliance.get_free_tools())
+    tools.extend(governance.get_tools())
+    tools.extend(monitoring.get_free_tools())
+    tools.extend(evidence.get_free_tools())
+    tools.extend(regulatory.get_tools())
+
+    if include_pro:
+        tools.extend(compliance.get_pro_tools())
+        tools.extend(evidence.get_pro_tools())
+        tools.extend(hitl.get_tools())
+        tools.extend(cost.get_tools())
+        tools.extend(monitoring.get_pro_tools())
+
+    return tools
+
+
+@app.list_tools()
+async def list_tools() -> list:
+    """Return all available IRIS tools."""
+    return collect_tools()
+
+
+@app.call_tool()
+async def call_tool(name: str, arguments: dict | None) -> list[TextContent]:
+    """Route tool calls to the appropriate handler."""
+    arguments = arguments or {}
+    router = {
+        "iris_scan_discover": discovery.scan_discover,
+        "iris_scan_govern": discovery.scan_govern,
+        "iris_list_agents": discovery.list_agents,
+        "iris_compliance_check": compliance.check,
+        "iris_framework_suggest": compliance.framework_suggest,
+        "iris_regulatory_check": regulatory.check,
+        "iris_compliance_assess": compliance.assess,
+        "iris_certify": compliance.certify,
+        "iris_policy_catalog": compliance.catalog,
+        "iris_declare": governance.declare,
+        "iris_compile_policy": governance.compile,
+        "iris_preview_policy": governance.preview,
+        "iris_status": monitoring.status,
+        "iris_witness_recent": monitoring.witness_recent,
+        "iris_sentinel_status": monitoring.sentinel_status,
+        "iris_drift_check": monitoring.drift_check,
+        "iris_evidence_summary": evidence.summary,
+        "iris_evidence_report": evidence.report,
+        "iris_evidence_export": evidence.export,
+        "iris_hitl_list": hitl.list_reviews,
+        "iris_hitl_approve": hitl.approve,
+        "iris_hitl_reject": hitl.reject,
+        "iris_hitl_rules": hitl.show_rules,
+        "iris_cost_report": cost.report,
+        "iris_cost_summary": cost.summary,
+        "iris_cost_optimize": cost.optimize,
+    }
+
+    handler = router.get(name)
+    if not handler:
+        return [TextContent(type="text", text=f"Unknown tool: {name}")]
+
+    return await handler(arguments)
+
+
+@app.list_resources()
+async def list_resources() -> list[Resource]:
+    """Return framework documentation as readable resources."""
+    return FRAMEWORK_RESOURCES
+
+
+@app.read_resource()
+async def read_resource(uri: str) -> str:
+    text = get_framework_text(str(uri))
+    if text is None:
+        raise ValueError(f"Unknown resource: {uri}")
+    return text
+
+
+@app.list_prompts()
+async def list_prompts() -> list[Prompt]:
+    """Return pre-built prompts for common IRIS tasks."""
+    return [
+        Prompt(
+            name="govern_new_agent",
+            description="Walk through governing a new AI agent from scratch",
+            arguments=[
+                {"name": "agent_name", "description": "Name of the agent", "required": True},
+                {"name": "domain", "description": "What the agent does", "required": True},
+            ],
+        ),
+        Prompt(
+            name="compliance_review",
+            description="Run a full compliance review for an agent",
+            arguments=[
+                {"name": "agent_name", "description": "Agent to review", "required": True},
+            ],
+        ),
+        Prompt(
+            name="explain_framework",
+            description="Explain a compliance framework in plain English",
+            arguments=[
+                {"name": "framework", "description": "Framework ID", "required": True},
+            ],
+        ),
+    ]
+
+
+@app.get_prompt()
+async def get_prompt(name: str, arguments: dict[str, str] | None) -> GetPromptResult:
+    arguments = arguments or {}
+    if name == "govern_new_agent":
+        agent = arguments.get("agent_name", "my-agent")
+        domain = arguments.get("domain", "AI assistant")
+        text = (
+            f"Help me govern a new AI agent named {agent}.\n"
+            f"It does: {domain}\n\n"
+            f"Use iris_declare, then iris_compile_policy, then iris_compliance_check."
+        )
+    elif name == "compliance_review":
+        agent = arguments.get("agent_name", "my-agent")
+        text = (
+            f"Run a full compliance review for agent {agent}.\n"
+            "Use iris_status, iris_framework_suggest, iris_compliance_check, "
+            "and iris_evidence_summary."
+        )
+    elif name == "explain_framework":
+        framework = arguments.get("framework", "colorado-ai-act")
+        text = (
+            f"Read iris://frameworks/{framework} and explain it in plain English "
+            "for a developer building AI agents."
+        )
+    else:
+        text = IRIS_SYSTEM_PROMPT
+
+    return GetPromptResult(
+        description=name,
+        messages=[PromptMessage(role="user", content=TextContent(type="text", text=text))],
+    )
+
+
+async def run_server() -> None:
+    async with stdio_server() as streams:
+        await app.run(
+            streams[0],
+            streams[1],
+            app.create_initialization_options(
+                instructions=IRIS_SYSTEM_PROMPT,
+            ),
+        )
+
+
+def cli_main() -> None:
+    parser = argparse.ArgumentParser(description="IRIS MCP Server")
+    parser.add_argument("--version", action="version", version=f"iris-mcp {__version__}")
+    parser.add_argument(
+        "--list-tools",
+        action="store_true",
+        help="List available MCP tools and exit",
+    )
+    parser.add_argument(
+        "--cursor-mode",
+        action="store_true",
+        help="Cursor IDE mode (stdio transport; reserved for future options)",
+    )
+    args = parser.parse_args()
+
+    if args.list_tools:
+        tools = collect_tools()
+        for tool in tools:
+            tier = "pro" if tool.name in {
+                "iris_compliance_assess",
+                "iris_certify",
+                "iris_policy_catalog",
+                "iris_sentinel_status",
+                "iris_drift_check",
+                "iris_evidence_report",
+                "iris_evidence_export",
+                "iris_hitl_list",
+                "iris_hitl_approve",
+                "iris_hitl_reject",
+                "iris_hitl_rules",
+                "iris_cost_report",
+                "iris_cost_summary",
+                "iris_cost_optimize",
+            } else "free"
+            print(f"{tool.name}\t{tier}\t{tool.description}")
+        return
+
+    if args.cursor_mode:
+        pass
+
+    try:
+        asyncio.run(run_server())
+    except KeyboardInterrupt:
+        sys.exit(0)
+
+
+def main() -> None:
+    cli_main()
+
+
+if __name__ == "__main__":
+    main()

iris_mcp/tools/__init__.py

@@ -0,0 +1 @@
+"""IRIS MCP tool modules."""

iris_mcp/tools/_common.py

@@ -0,0 +1,64 @@
+"""Shared helpers for IRIS MCP tools."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+from mcp.types import TextContent
+
+from iris_core.entitlements import Entitlements, Feature
+
+
+def text_response(text: str) -> list[TextContent]:
+    return [TextContent(type="text", text=text)]
+
+
+def scan_directory(arguments: dict[str, Any]) -> Path:
+    directory = arguments.get("directory")
+    if directory:
+        return Path(directory).expanduser().resolve()
+    return Path.cwd()
+
+
+def governance_dir(arguments: dict[str, Any] | None = None) -> Path:
+    arguments = arguments or {}
+    if arguments.get("governance_dir"):
+        return Path(arguments["governance_dir"]).expanduser().resolve()
+
+    env_dir = os.environ.get("IRIS_GOVERNANCE_DIR")
+    if env_dir:
+        path = Path(env_dir).expanduser().resolve()
+        if path.name == "agents":
+            return path
+        agents = path / "agents"
+        if agents.exists():
+            return agents
+        return path
+
+    return Path.cwd() / "governance" / "agents"
+
+
+def has_pro() -> bool:
+    return Entitlements().has(Feature.BUNDLE_HIPAA)
+
+
+def pro_gate(feature: Feature, upgrade_message: str) -> str | None:
+    if Entitlements().has(feature):
+        return None
+    return upgrade_message
+
+
+def format_table(headers: list[str], rows: list[list[str]]) -> str:
+    if not rows:
+        return "No results."
+    widths = [len(h) for h in headers]
+    for row in rows:
+        for idx, cell in enumerate(row):
+            widths[idx] = max(widths[idx], len(cell))
+    sep = "  ".join(h.ljust(widths[i]) for i, h in enumerate(headers))
+    lines = [sep, "-" * len(sep)]
+    for row in rows:
+        lines.append("  ".join(row[i].ljust(widths[i]) for i in range(len(headers))))
+    return "\n".join(lines)