mcp-security-framework 2.2.0__tar.gz → 2.2.1__tar.gz

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.2.0
+Version: 2.2.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.2.0"
+__version__ = "2.2.1"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/mcp_security_framework/core/ssl_manager.py

@@ -235,10 +235,22 @@ class SSLManager:
 
             # Validate required files or data
             if cert_data is None and not cert_file:
+                if self.config.material_from_memory:
+                    raise SSLConfigurationError(
+                        "material_from_memory=True but cert_data was not supplied; "
+                        "provide cert_data as PEM bytes or "
+                        "set material_from_memory=False"
+                    )
                 raise SSLConfigurationError(
                     "Server certificate file or data is required"
                 )
             if key_data is None and not key_file:
+                if self.config.material_from_memory:
+                    raise SSLConfigurationError(
+                        "material_from_memory=True but key_data was not supplied; "
+                        "provide key_data as PEM bytes or "
+                        "set material_from_memory=False"
+                    )
                 raise SSLConfigurationError(
                     "Server private key file or data is required"
                 )
@@ -423,6 +435,18 @@ class SSLManager:
             verify_mode = verify_mode or self.config.verify_mode
             min_version = min_version or self.config.min_tls_version
 
+            # Validate that material_from_memory promises are kept
+            if cert_data is None and self.config.material_from_memory:
+                raise SSLConfigurationError(
+                    "material_from_memory=True but cert_data was not supplied; "
+                    "provide cert_data as PEM bytes or set material_from_memory=False"
+                )
+            if key_data is None and self.config.material_from_memory:
+                raise SSLConfigurationError(
+                    "material_from_memory=True but key_data was not supplied; "
+                    "provide key_data as PEM bytes or set material_from_memory=False"
+                )
+
             # Check cache (only for file-based contexts)
             cache_key = None
             if cert_data is None and key_data is None:

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/mcp_security_framework/examples/protected_keys_example.py

@@ -57,7 +57,7 @@ def _build_certificate_config() -> CertificateConfig:
 
 def _build_ssl_config() -> SSLConfig:
     """Build a temporary SSL configuration for this example."""
-    return SSLConfig(enabled=True, verify=False)
+    return SSLConfig(enabled=True, verify=False, material_from_memory=False)
 
 
 def _create_encrypted_key(password: str) -> tuple:
@@ -88,7 +88,6 @@ def main() -> None:
     print("=" * 70)
 
     cert_config = _build_certificate_config()
-    ssl_config = _build_ssl_config()
 
     # Capability 1: Create a root CA with a passphrase-protected key
     print("\n1. Creating a root CA with a passphrase-protected private key...")
@@ -182,18 +181,24 @@ def main() -> None:
         else:
             raise
 
-    # Capability 5: Create SSL context from in-memory cert and key bytes
+    # Capability 5: Create SSL context from in-memory bytes (SECURE config)
     print("\n5. Creating SSL context from in-memory certificate and key bytes...")
     with open(server_pair.certificate_path, "rb") as f:
         cert_bytes = f.read()
     with open(server_pair.private_key_path, "rb") as f:
         key_bytes = f.read()
 
-    ssl_manager = SSLManager(ssl_config)
+    secure_ssl_config = SSLConfig(enabled=True, verify=True, material_from_memory=True)
+    print(
+        f"   Config: enabled={secure_ssl_config.enabled}, "
+        f"verify={secure_ssl_config.verify}, "
+        f"material_from_memory={secure_ssl_config.material_from_memory}"
+    )
+    ssl_manager = SSLManager(secure_ssl_config)
     _ = ssl_manager.create_server_context(cert_data=cert_bytes, key_data=key_bytes)
-    print("   SSL context created from in-memory bytes: SUCCESS")
+    print("   SSL context created from in-memory bytes (SECURE): SUCCESS")
 
-    # Capability 6: Create SSL context from encrypted in-memory key with password
+    # Capability 6: Create SSL context from encrypted in-memory key (SECURE)
     print("\n6. Creating SSL context from encrypted in-memory key with passphrase...")
     # Read the original server key and encrypt it
     with open(server_pair.private_key_path, "rb") as f:
@@ -212,13 +217,21 @@ def main() -> None:
     )
 
     ssl_config_with_password = SSLConfig(
-        enabled=True, verify=False, key_password="test_pass"
+        enabled=True,
+        verify=True,
+        material_from_memory=True,
+        key_password="test_pass",
+    )
+    print(
+        f"   Config: enabled={ssl_config_with_password.enabled}, "
+        f"verify={ssl_config_with_password.verify}, "
+        f"material_from_memory={ssl_config_with_password.material_from_memory}"
     )
     ssl_manager_with_pass = SSLManager(ssl_config_with_password)
     _ = ssl_manager_with_pass.create_server_context(
         cert_data=cert_bytes, key_data=encrypted_server_key
     )
-    print("   SSL context created from encrypted in-memory key: SUCCESS")
+    print("   SSL context created from encrypted in-memory key (SECURE): SUCCESS")
 
     # Capability 7: Try cert_data without key_data (should fail)
     print("\n7. Attempting to supply cert_data without key_data (should fail)...")
@@ -231,7 +244,7 @@ def main() -> None:
         else:
             raise
 
-    # Capability 8: Create a CA workflow entirely from PEM bytes (no disk files)
+    # Capability 8: Create CA workflow from PEM bytes (no disk files) SECURE config
     print("\n8. Running complete CA workflow from PEM bytes (no disk CA files)...")
 
     # Create a root CA for this demonstration
@@ -283,9 +296,13 @@ def main() -> None:
         encryption_algorithm=serialization.NoEncryption(),
     )
 
-    # Now use those bytes through the SSL context
-    _ = ssl_manager.create_server_context(cert_data=ca_cert_pem, key_data=ca_key_pem)
-    print("   CA workflow completed entirely in memory: SUCCESS")
+    # Now use those bytes through the SSL context with secure config
+    secure_ca_config = SSLConfig(enabled=True, verify=True, material_from_memory=True)
+    secure_ca_manager = SSLManager(secure_ca_config)
+    _ = secure_ca_manager.create_server_context(
+        cert_data=ca_cert_pem, key_data=ca_key_pem
+    )
+    print("   CA workflow completed entirely in memory (SECURE): SUCCESS")
 
     msg = "ALL PROTECTED KEY AND IN-MEMORY MATERIAL CAPABILITIES "
     msg += "DEMONSTRATED SUCCESSFULLY"

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/mcp_security_framework/schemas/config.py

@@ -93,6 +93,7 @@ class SSLConfig(BaseModel):
         client_cert_file: Path to client certificate file
         client_key_file: Path to client private key file
         client_key_password: Passphrase for client private key file
+        material_from_memory: Certificate and key supplied as PEM bytes, not files
         verify_mode: SSL verification mode
         min_tls_version: Minimum TLS version to support
         max_tls_version: Maximum TLS version to support
@@ -132,6 +133,13 @@ class SSLConfig(BaseModel):
         default=None, description="Passphrase for client private key file"
     )
     verify: bool = Field(default=True, description="Whether to verify SSL certificates")
+    material_from_memory: bool = Field(
+        default=False,
+        description=(
+            "Certificate and key are supplied to the context builders as PEM "
+            "bytes rather than named by cert_file/key_file"
+        ),
+    )
     verify_mode: str = Field(
         default="CERT_REQUIRED", description="SSL verification mode"
     )
@@ -223,12 +231,21 @@ class SSLConfig(BaseModel):
     def validate_ssl_configuration(self) -> Self:
         """Validate SSL configuration consistency."""
         if self.enabled:
-            # If verify is disabled, don't require certificate files
-            if self.verify and (not self.cert_file or not self.key_file):
-                raise ValueError(
-                    "SSL enabled with verification but certificate and key files are "
-                    "required"
-                )
+            # If verify is disabled, don't require certificate files or memory flag
+            if self.verify and not self.material_from_memory:
+                # material_from_memory=False means files are required.
+                # material_from_memory=True means bytes will be supplied at call time,
+                # so files are not checked here. This keeps the early error for the
+                # common case — everyone who configures file paths — and makes the
+                # intent visible in the configuration itself, which is where an auditor
+                # will look. An explicit opt-in prevents the false positive that occurs
+                # when someone sets verify=True in secure-by-default code but hasn't yet
+                # assembled the bytes.
+                if not self.cert_file or not self.key_file:
+                    raise ValueError(
+                        "SSL enabled with verification but certificate and key "
+                        "files are required"
+                    )
         return self
 
 

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/mcp_security_framework.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.2.0
+Version: 2.2.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.2.0 → mcp_security_framework-2.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mcp-security-framework"
-version = "2.2.0"
+version = "2.2.1"
 description = "Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations."
 readme = "README.md"
 license = {text = "MIT"}