mcp-security-framework 2.0.1__tar.gz → 2.2.0__tar.gz

{mcp_security_framework-2.0.1 → mcp_security_framework-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.0.1
+Version: 2.2.0
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.0.1 → mcp_security_framework-2.2.0}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.0.1"
+__version__ = "2.2.0"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.0.1 → mcp_security_framework-2.2.0}/mcp_security_framework/cli/cert_cli.py

@@ -27,7 +27,7 @@ License: MIT
 
 import json
 import os
-from typing import Optional
+from typing import List, Optional, Tuple
 
 import click
 
@@ -47,7 +47,7 @@ from ..schemas.config import (
 )
 @click.option("--verbose", "-v", is_flag=True, help="Enable verbose output")
 @click.pass_context
-def cert_cli(ctx, config_path: Optional[str], verbose: bool):
+def cert_cli(ctx: click.Context, config_path: Optional[str], verbose: bool) -> None:
     """
     Certificate Management CLI
 
@@ -88,7 +88,7 @@ def cert_cli(ctx, config_path: Optional[str], verbose: bool):
     # _get_cert_manager(ctx), only once its own body actually runs.
 
 
-def _get_cert_manager(ctx) -> CertificateManager:
+def _get_cert_manager(ctx: click.Context) -> CertificateManager:
     """
     Lazily construct (and cache) the CertificateManager for this invocation.
 
@@ -110,10 +110,11 @@ def _get_cert_manager(ctx) -> CertificateManager:
     """
     if "cert_manager" not in ctx.obj:
         ctx.obj["cert_manager"] = CertificateManager(ctx.obj["config"])
-    return ctx.obj["cert_manager"]
+    cert_manager: CertificateManager = ctx.obj["cert_manager"]
+    return cert_manager
 
 
-def _validate_permissions(permissions: tuple) -> list:
+def _validate_permissions(permissions: Tuple[str, ...]) -> List[str]:
     """
     Validate permission strings supplied via ``--permissions``.
 
@@ -179,7 +180,7 @@ def _validate_permissions(permissions: tuple) -> list:
 @click.option("--key-size", "-k", default=2048, help="RSA key size")
 @click.pass_context
 def create_ca(
-    ctx,
+    ctx: click.Context,
     common_name: str,
     organization: str,
     country: str,
@@ -188,7 +189,7 @@ def create_ca(
     email: Optional[str],
     validity_years: int,
     key_size: int,
-):
+) -> None:
     """
     Create a root CA certificate.
 
@@ -263,7 +264,7 @@ def create_ca(
 @click.option("--ca-key", required=True, help="Path to the signing CA private key")
 @click.pass_context
 def create_server(
-    ctx,
+    ctx: click.Context,
     common_name: str,
     organization: str,
     country: str,
@@ -272,12 +273,12 @@ def create_server(
     email: Optional[str],
     validity_days: int,
     key_size: int,
-    san: tuple,
-    key_usage: tuple,
-    extended_key_usage: tuple,
+    san: Tuple[str, ...],
+    key_usage: Tuple[str, ...],
+    extended_key_usage: Tuple[str, ...],
     ca_cert: str,
     ca_key: str,
-):
+) -> None:
     """
     Create a server certificate.
 
@@ -287,30 +288,40 @@ def create_server(
         cert_manager = _get_cert_manager(ctx)
         verbose = ctx.obj["verbose"]
 
-        # Create server configuration
-        server_config_kwargs = {
-            "common_name": common_name,
-            "organization": organization,
-            "country": country,
-            "state": state,
-            "locality": locality,
-            "email": email,
-            "validity_days": validity_days,
-            "key_size": key_size,
-            "subject_alt_names": list(san) if san else [],
-            "ca_cert_path": ca_cert,
-            "ca_key_path": ca_key,
-        }
-
-        # Only include key_usage if provided (to allow pydantic defaults)
-        if key_usage:
-            server_config_kwargs["key_usage"] = list(key_usage)
-
-        # Only include extended_key_usage if provided (to allow pydantic defaults)
-        if extended_key_usage:
-            server_config_kwargs["extended_key_usage"] = list(extended_key_usage)
-
-        server_config = ServerCertConfig(**server_config_kwargs)
+        # Create server configuration.
+        #
+        # key_usage/extended_key_usage fall back to ServerCertConfig's own
+        # field defaults (read from the model rather than duplicated here)
+        # when the flag is not given, instead of an empty list -- an empty
+        # list would silently strip the default key usage extensions from
+        # every certificate that does not pass --key-usage explicitly.
+        # Reading the defaults from the model, rather than a **kwargs dict
+        # assembled conditionally, also keeps every field's real type
+        # (str, Optional[str], int, List[str]) visible to the type checker
+        # instead of collapsing them into one imprecise union.
+        key_usage_default = ServerCertConfig.model_fields["key_usage"].default
+        extended_key_usage_default = ServerCertConfig.model_fields[
+            "extended_key_usage"
+        ].default
+        server_config = ServerCertConfig(
+            common_name=common_name,
+            organization=organization,
+            country=country,
+            state=state,
+            locality=locality,
+            email=email,
+            validity_days=validity_days,
+            key_size=key_size,
+            subject_alt_names=list(san) if san else [],
+            key_usage=list(key_usage) if key_usage else list(key_usage_default),
+            extended_key_usage=(
+                list(extended_key_usage)
+                if extended_key_usage
+                else list(extended_key_usage_default)
+            ),
+            ca_cert_path=ca_cert,
+            ca_key_path=ca_key,
+        )
 
         if verbose:
             click.echo("Creating server certificate with configuration:")
@@ -365,7 +376,7 @@ def create_server(
 @click.option("--ca-key", required=True, help="Path to the signing CA private key")
 @click.pass_context
 def create_client(
-    ctx,
+    ctx: click.Context,
     common_name: str,
     organization: str,
     country: str,
@@ -374,11 +385,11 @@ def create_client(
     email: Optional[str],
     validity_days: int,
     key_size: int,
-    roles: tuple,
-    permissions: tuple,
+    roles: Tuple[str, ...],
+    permissions: Tuple[str, ...],
     ca_cert: str,
     ca_key: str,
-):
+) -> None:
     """
     Create a client certificate.
 
@@ -443,7 +454,9 @@ def create_client(
     help="Path to CRL file for revocation check",
 )
 @click.pass_context
-def validate(ctx, cert_path: str, ca_cert: Optional[str], crl: Optional[str]):
+def validate(
+    ctx: click.Context, cert_path: str, ca_cert: Optional[str], crl: Optional[str]
+) -> None:
     """
     Validate a certificate.
 
@@ -480,7 +493,7 @@ def validate(ctx, cert_path: str, ca_cert: Optional[str], crl: Optional[str]):
 @cert_cli.command()
 @click.argument("cert_path", type=click.Path(exists=True))
 @click.pass_context
-def info(ctx, cert_path: str):
+def info(ctx: click.Context, cert_path: str) -> None:
     """
     Display certificate information.
 
@@ -543,7 +556,7 @@ def info(ctx, cert_path: str):
 )
 @click.pass_context
 def create_intermediate_ca(
-    ctx,
+    ctx: click.Context,
     common_name: str,
     organization: str,
     country: str,
@@ -554,7 +567,7 @@ def create_intermediate_ca(
     key_size: int,
     parent_ca_cert: str,
     parent_ca_key: str,
-):
+) -> None:
     """
     Create an intermediate CA certificate.
 
@@ -612,8 +625,12 @@ def create_intermediate_ca(
 @click.option("--validity-days", "-d", default=30, help="CRL validity in days")
 @click.pass_context
 def create_crl(
-    ctx, ca_cert: str, ca_key: str, output: Optional[str], validity_days: int
-):
+    ctx: click.Context,
+    ca_cert: str,
+    ca_key: str,
+    output: Optional[str],
+    validity_days: int,
+) -> None:
     """
     Create a Certificate Revocation List (CRL).
 
@@ -653,7 +670,7 @@ def create_crl(
 @click.argument("serial_number")
 @click.option("--reason", "-r", default="unspecified", help="Reason for revocation")
 @click.pass_context
-def revoke(ctx, serial_number: str, reason: str):
+def revoke(ctx: click.Context, serial_number: str, reason: str) -> None:
     """
     Revoke a certificate.
 
@@ -690,7 +707,7 @@ def revoke(ctx, serial_number: str, reason: str):
     help="Path to CRL file for revocation check",
 )
 @click.pass_context
-def check_revocation(ctx, cert_path: str, crl: Optional[str]):
+def check_revocation(ctx: click.Context, cert_path: str, crl: Optional[str]) -> None:
     """
     Check if certificate is revoked according to CRL.
 
@@ -726,7 +743,7 @@ def check_revocation(ctx, cert_path: str, crl: Optional[str]):
     help="Path to CRL file for detailed revocation check",
 )
 @click.pass_context
-def revocation_info(ctx, cert_path: str, crl: Optional[str]):
+def revocation_info(ctx: click.Context, cert_path: str, crl: Optional[str]) -> None:
     """
     Get detailed revocation information for certificate.
 
@@ -742,7 +759,7 @@ def revocation_info(ctx, cert_path: str, crl: Optional[str]):
             if crl:
                 click.echo(f"Using CRL file: {crl}")
 
-        # Get detailed revocation information
+        # Get detailed revocation information.
         revocation_info = cert_manager.validate_certificate_against_crl(cert_path, crl)
 
         click.echo(f"Certificate Serial Number: {revocation_info['serial_number']}")
@@ -765,7 +782,7 @@ def revocation_info(ctx, cert_path: str, crl: Optional[str]):
 @cert_cli.command()
 @click.argument("crl_path", type=click.Path(exists=True))
 @click.pass_context
-def crl_info(ctx, crl_path: str):
+def crl_info(ctx: click.Context, crl_path: str) -> None:
     """
     Display CRL information.
 
@@ -807,7 +824,7 @@ def crl_info(ctx, crl_path: str):
 @cert_cli.command()
 @click.argument("crl_path", type=click.Path(exists=True))
 @click.pass_context
-def validate_crl(ctx, crl_path: str):
+def validate_crl(ctx: click.Context, crl_path: str) -> None:
     """
     Validate CRL file.
 

{mcp_security_framework-2.0.1 → mcp_security_framework-2.2.0}/mcp_security_framework/cli/security_cli.py

@@ -27,7 +27,7 @@ License: MIT
 import json
 import os
 from datetime import datetime
-from typing import Optional
+from typing import Any, Dict, Optional, Tuple
 
 import click
 
@@ -47,7 +47,7 @@ from ..schemas.config import (
 )
 @click.option("--verbose", "-v", is_flag=True, help="Enable verbose output")
 @click.pass_context
-def security_cli(ctx, config_path: Optional[str], verbose: bool):
+def security_cli(ctx: click.Context, config_path: Optional[str], verbose: bool) -> None:
     """
     Security Management CLI
 
@@ -90,7 +90,7 @@ def security_cli(ctx, config_path: Optional[str], verbose: bool):
     # _get_security_manager(ctx), only once its own body actually runs.
 
 
-def _get_security_manager(ctx) -> SecurityManager:
+def _get_security_manager(ctx: click.Context) -> SecurityManager:
     """
     Lazily construct (and cache) the SecurityManager for this invocation.
 
@@ -113,12 +113,13 @@ def _get_security_manager(ctx) -> SecurityManager:
     """
     if "security_manager" not in ctx.obj:
         ctx.obj["security_manager"] = SecurityManager(ctx.obj["config"])
-    return ctx.obj["security_manager"]
+    security_manager: SecurityManager = ctx.obj["security_manager"]
+    return security_manager
 
 
 @security_cli.group()
 @click.pass_context
-def auth(ctx):
+def auth(ctx: click.Context) -> None:
     """
     Authentication operations.
 
@@ -132,7 +133,7 @@ def auth(ctx):
 @click.option("--username", "-u", required=True, help="Username for the API key")
 @click.option("--api-key", "-k", required=True, help="API key value")
 @click.pass_context
-def add_api_key(ctx, username: str, api_key: str):
+def add_api_key(ctx: click.Context, username: str, api_key: str) -> None:
     """
     Add an API key for a user.
 
@@ -163,7 +164,7 @@ def add_api_key(ctx, username: str, api_key: str):
 @auth.command()
 @click.option("--username", "-u", required=True, help="Username to remove API key for")
 @click.pass_context
-def remove_api_key(ctx, username: str):
+def remove_api_key(ctx: click.Context, username: str) -> None:
     """
     Remove an API key for a user.
 
@@ -194,7 +195,7 @@ def remove_api_key(ctx, username: str):
 @auth.command()
 @click.option("--api-key", "-k", required=True, help="API key to test")
 @click.pass_context
-def test_api_key(ctx, api_key: str):
+def test_api_key(ctx: click.Context, api_key: str) -> None:
     """
     Test API key authentication.
 
@@ -229,7 +230,7 @@ def test_api_key(ctx, api_key: str):
 @auth.command()
 @click.option("--token", "-t", required=True, help="JWT token to test")
 @click.pass_context
-def test_jwt(ctx, token: str):
+def test_jwt(ctx: click.Context, token: str) -> None:
     """
     Test JWT token authentication.
 
@@ -263,7 +264,7 @@ def test_jwt(ctx, token: str):
 
 @security_cli.group()
 @click.pass_context
-def permissions(ctx):
+def permissions(ctx: click.Context) -> None:
     """
     Permission management operations.
 
@@ -285,7 +286,7 @@ def permissions(ctx):
     help="Permissions to check (can be specified multiple times)",
 )
 @click.pass_context
-def check(ctx, username: str, permissions: tuple):
+def check(ctx: click.Context, username: str, permissions: Tuple[str, ...]) -> None:
     """
     Check user permissions.
 
@@ -334,7 +335,7 @@ def check(ctx, username: str, permissions: tuple):
 @permissions.command()
 @click.option("--role", "-r", required=True, help="Role name")
 @click.pass_context
-def list_role_permissions(ctx, role: str):
+def list_role_permissions(ctx: click.Context, role: str) -> None:
     """
     List permissions for a role.
 
@@ -364,7 +365,7 @@ def list_role_permissions(ctx, role: str):
 
 @security_cli.group()
 @click.pass_context
-def rate_limit(ctx):
+def rate_limit(ctx: click.Context) -> None:
     """
     Rate limiting operations.
 
@@ -382,7 +383,7 @@ def rate_limit(ctx):
     help="Rate limit identifier (IP, user ID, etc.)",
 )
 @click.pass_context
-def rate_limit_check(ctx, identifier: str):
+def rate_limit_check(ctx: click.Context, identifier: str) -> None:
     """
     Check rate limit status.
 
@@ -414,7 +415,7 @@ def rate_limit_check(ctx, identifier: str):
     "--identifier", "-i", required=True, help="Rate limit identifier to reset"
 )
 @click.pass_context
-def reset(ctx, identifier: str):
+def reset(ctx: click.Context, identifier: str) -> None:
     """
     Reset rate limit for an identifier.
 
@@ -442,7 +443,7 @@ def reset(ctx, identifier: str):
     "--identifier", "-i", required=True, help="Rate limit identifier to get status for"
 )
 @click.pass_context
-def rate_limit_status(ctx, identifier: str):
+def rate_limit_status(ctx: click.Context, identifier: str) -> None:
     """
     Get rate limit status for an identifier.
 
@@ -472,7 +473,7 @@ def rate_limit_status(ctx, identifier: str):
 
 @security_cli.group()
 @click.pass_context
-def config(ctx):
+def config(ctx: click.Context) -> None:
     """
     Configuration management operations.
 
@@ -484,7 +485,7 @@ def config(ctx):
 
 @config.command()
 @click.pass_context
-def validate(ctx):
+def validate(ctx: click.Context) -> None:
     """
     Validate security configuration.
 
@@ -536,7 +537,7 @@ def validate(ctx):
     "--output", "-o", type=click.Path(), help="Output file path (default: stdout)"
 )
 @click.pass_context
-def export(ctx, output: Optional[str]):
+def export(ctx: click.Context, output: Optional[str]) -> None:
     """
     Export security configuration.
 
@@ -573,7 +574,7 @@ def export(ctx, output: Optional[str]):
     "--template", "-t", is_flag=True, help="Generate template roles configuration"
 )
 @click.pass_context
-def generate_roles(ctx, output: Optional[str], template: bool):
+def generate_roles(ctx: click.Context, output: Optional[str], template: bool) -> None:
     """
     Generate roles configuration file.
 
@@ -651,7 +652,7 @@ def generate_roles(ctx, output: Optional[str], template: bool):
     help="Output format for audit report",
 )
 @click.pass_context
-def security_audit(ctx, output: Optional[str], format: str):
+def security_audit(ctx: click.Context, output: Optional[str], format: str) -> None:
     """
     Perform security audit.
 
@@ -667,7 +668,14 @@ def security_audit(ctx, output: Optional[str], format: str):
             click.echo("Performing security audit...")
 
         # Perform security audit
-        audit_results = {
+        #
+        # This report is a genuinely heterogeneous JSON-shaped structure:
+        # values are bools, strings, lists, dicts, and Nones. It is built once
+        # and either serialised (json.dumps) or rendered as text below, so a
+        # precise per-key TypedDict would buy nothing here. Dict[str, Any] is
+        # the honest, minimal-loss type for exactly this shape -- not a
+        # stand-in for a type that could otherwise be pinned down.
+        audit_results: Dict[str, Any] = {
             "timestamp": datetime.now().isoformat(),
             "configuration": {
                 "authentication": {
@@ -849,7 +857,7 @@ def security_audit(ctx, output: Optional[str], format: str):
 
 @security_cli.command()
 @click.pass_context
-def status(ctx):
+def status(ctx: click.Context) -> None:
     """
     Display security status.
 

{mcp_security_framework-2.0.1 → mcp_security_framework-2.2.0}/mcp_security_framework/core/auth_manager.py

@@ -46,6 +46,7 @@ from ..utils.crypto_utils import (
 from ..utils.datetime_compat import (
     get_not_valid_after_utc,
 )
+from .cert_manager import CertificateValidationError
 
 
 class AuthManager:
@@ -697,7 +698,8 @@ class AuthManager:
                 },
             )
             raise CertificateValidationError(
-                f"Certificate authentication failed: {str(e)}"
+                f"Certificate authentication failed: {str(e)}",
+                error_code=-32004,
             )
 
     def create_jwt_token(self, user_data: Dict) -> str:
@@ -1087,19 +1089,10 @@ class JWTValidationError(Exception):
         super().__init__(self.message)
 
 
-class CertificateValidationError(Exception):
-    """Raised when certificate validation fails."""
-
-    def __init__(self, message: str, error_code: int = -32004):
-        """
-        Initialize CertificateValidationError.
-
-        Args:
-            message (str): Human-readable error message describing
-                the certificate validation failure.
-            error_code (int): Error code for the certificate validation
-                error. Defaults to -32004.
-        """
-        self.message = message
-        self.error_code = error_code
-        super().__init__(self.message)
+# ``CertificateValidationError`` is defined once, in ``cert_manager``, and
+# re-exported here so that ``from .auth_manager import CertificateValidationError``
+# keeps working. Every module in this package that raises a certificate
+# validation failure must raise (and every caller must be able to catch) the
+# SAME class -- see ``cert_manager.CertificateValidationError`` for the
+# rationale and for why the per-site error code is passed at construction
+# instead of being encoded as a second, look-alike class.