orithos-cli 0.1.0__py3-none-any.whl

orithos_cli/mcp.py

@@ -0,0 +1,170 @@
+"""MCP (Model Context Protocol) commands."""
+
+from __future__ import annotations
+
+import json
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="mcp")
+def mcp_group() -> None:
+    """Interact with Orithos's MCP policy server."""
+    pass
+
+
+@mcp_group.command("tools")
+@click.option(
+    "--format",
+    "output_format",
+    type=click.Choice(["summary", "json"]),
+    default="summary",
+)
+def list_tools(output_format: str) -> None:
+    """List all available MCP tools."""
+    cfg = get_config()
+
+    try:
+        response = httpx.get(
+            f"{cfg.api_url}/v1/mcp/tools",
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(f"Connection error: {exc}", err=True)
+        raise SystemExit(1)
+
+    data = response.json()
+    tools = data.get("tools", [])
+
+    if output_format == "json":
+        click.echo(json.dumps(tools, indent=2))
+        return
+
+    click.echo(f"Orithos MCP Tools ({len(tools)} available)")
+    click.echo(f"{'=' * 60}")
+    for tool in tools:
+        click.echo(f"\n{tool['name']}")
+        click.echo(f"  {tool['description']}")
+        input_schema = tool.get("input_schema", {})
+        props = input_schema.get("properties", {})
+        if props:
+            click.echo("  Parameters:")
+            for param_name, param_info in props.items():
+                required = param_name in input_schema.get("required", [])
+                req_mark = "*" if required else ""
+                click.echo(
+                    f"    {req_mark}{param_name}: {param_info.get('description', '—')}"
+                )
+
+
+@mcp_group.command("evaluate")
+@click.option("--tool-name", required=True, help="Tool name (e.g. filesystem.write)")
+@click.option("--scope", default="internal", help="Scope (e.g. internal, external)")
+@click.option("--action", default="read", help="Action (e.g. read, write, delete)")
+def policy_evaluate(tool_name: str, scope: str, action: str) -> None:
+    """Evaluate a tool policy decision via MCP."""
+    cfg = get_config()
+
+    rpc_payload = {
+        "jsonrpc": "2.0",
+        "id": 1,
+        "method": "tools/call",
+        "params": {
+            "name": "orithos_policy_evaluate",
+            "arguments": {"tool_name": tool_name, "scope": scope, "action": action},
+        },
+    }
+
+    try:
+        response = httpx.post(
+            f"{cfg.api_url}/v1/mcp",
+            json=rpc_payload,
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(f"Connection error: {exc}", err=True)
+        raise SystemExit(1)
+
+    result = response.json()
+    tool_results = result.get("tools", [])
+    if tool_results:
+        first = tool_results[0]
+        output_schema = first.get("output_schema", {})
+        success = (
+            output_schema.get("properties", {}).get("success", {}).get("type")
+            == "boolean"
+        )
+        click.echo(f"Policy decision for {tool_name} ({scope}, {action}):")
+        click.echo(
+            f"  Decision: {first.get('output_schema', {}).get('properties', {}).get('decision', {}).get('enum', ['N/A'])}"
+        )
+        click.echo(
+            f"  Success: {first.get('output_schema', {}).get('properties', {}).get('success', 'N/A')}"
+        )
+    else:
+        click.echo(json.dumps(result, indent=2))
+
+
+@mcp_group.command("risk-score")
+@click.option(
+    "--tool-chain",
+    required=True,
+    help="Comma-separated tool chain (e.g. browser.fetch,memory.read,network.post)",
+)
+def risk_score(tool_chain: str) -> None:
+    """Score the risk of a tool chain via MCP."""
+    cfg = get_config()
+    tools = [t.strip() for t in tool_chain.split(",") if t.strip()]
+
+    rpc_payload = {
+        "jsonrpc": "2.0",
+        "id": 1,
+        "method": "tools/call",
+        "params": {
+            "name": "orithos_risk_score",
+            "arguments": {"tool_chain": tools},
+        },
+    }
+
+    try:
+        response = httpx.post(
+            f"{cfg.api_url}/v1/mcp",
+            json=rpc_payload,
+            headers=cfg.auth_headers(),
+            timeout=cfg.timeout,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except httpx.RequestError as exc:
+        click.echo(f"Connection error: {exc}", err=True)
+        raise SystemExit(1)
+
+    result = response.json()
+    tool_results = result.get("tools", [])
+    if tool_results:
+        output = tool_results[0].get("output_schema", {}).get("properties", {})
+        click.echo(f"Risk Score — tool chain: {tool_chain}")
+        click.echo(
+            f"  Overall risk: {output.get('overall_risk', {}).get('enum', ['N/A'])}"
+        )
+        click.echo(f"  Score: {output.get('score', 'N/A')}")
+        edges = output.get("vulnerable_edges", {}).get("items", {})
+        click.echo(f"  Vulnerable edges: {output.get('vulnerable_edges', [])}")
+        click.echo(f"  Risk factors: {output.get('risk_factors', [])}")
+    else:
+        click.echo(json.dumps(result, indent=2))

orithos_cli/output.py

@@ -0,0 +1,178 @@
+"""Output formatters for Orithos CLI."""
+
+from __future__ import annotations
+
+import html
+import json
+from dataclasses import dataclass
+
+
+@dataclass
+class FindingOutput:
+    id: str
+    scan_run_id: str
+    severity: str
+    attack_path: str
+    recommendation: str
+    created_at: str
+
+    def __init__(self, **kwargs):
+        self.id = kwargs.get("id", "")
+        self.scan_run_id = kwargs.get("scan_run_id", "")
+        self.severity = kwargs.get("severity", "low")
+        self.attack_path = kwargs.get("attack_path") or kwargs.get("name", "")
+        self.recommendation = kwargs.get("recommendation", "")
+        self.created_at = kwargs.get("created_at", "")
+
+
+@dataclass
+class ScanStatusOutput:
+    id: str
+    status: str
+    severity: str | None
+    total_tests: int
+    completed_tests: int
+
+
+def format_summary(findings: list[FindingOutput], scan: ScanStatusOutput) -> str:
+    lines = [
+        "Orithos Scan Results",
+        f"{'=' * 50}",
+        f"Scan ID:    {scan.id}",
+        f"Status:     {scan.status}",
+        f"Severity:   {scan.severity or 'N/A'}",
+        f"Tests:      {scan.completed_tests}/{scan.total_tests}",
+        f"Findings:   {len(findings)}",
+    ]
+    if findings:
+        lines.append("")
+        lines.append("Findings:")
+        for i, f in enumerate(findings, 1):
+            lines.append(f"  [{i}] {f.severity.upper()}: {f.attack_path}")
+            lines.append(f"      {f.recommendation}")
+    else:
+        lines.append("")
+        lines.append("No findings — agent is secure.")
+    return "\n".join(lines)
+
+
+def format_json(findings: list[FindingOutput], scan: ScanStatusOutput) -> str:
+    return json.dumps(
+        {
+            "scan": {
+                "id": scan.id,
+                "status": scan.status,
+                "severity": scan.severity,
+                "total_tests": scan.total_tests,
+                "completed_tests": scan.completed_tests,
+            },
+            "findings": [
+                {
+                    "id": f.id,
+                    "scan_run_id": f.scan_run_id,
+                    "severity": f.severity,
+                    "attack_path": f.attack_path,
+                    "recommendation": f.recommendation,
+                    "created_at": f.created_at,
+                }
+                for f in findings
+            ],
+        },
+        indent=2,
+    )
+
+
+def format_sarif(findings: list[FindingOutput], scan: ScanStatusOutput, api_url: str = "https://orithos.com") -> str:
+    results = []
+    severity_map = {"high": "error", "medium": "warning", "low": "note"}
+
+    for f in findings:
+        results.append(
+            {
+                "ruleId": f"TRACESHIELD-{f.severity.upper()}",
+                "severity": severity_map.get(f.severity, "note"),
+                "message": {"text": f.recommendation},
+                "locations": [
+                    {
+                        "physicalLocation": {
+                            "artifactLocation": {"uri": f.attack_path},
+                            "region": {"startLine": 1, "startColumn": 1},
+                        }
+                    }
+                ],
+                "properties": {
+                    "attack_path": f.attack_path,
+                    "scan_id": scan.id,
+                },
+            }
+        )
+
+    sarif = {
+        "version": "2.1.0",
+        "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "Orithos",
+                        "version": "0.1.0",
+                        "informationUri": api_url,
+                        "rules": [
+                            {
+                                "id": "TRACESHIELD-HIGH",
+                                "name": "HighSeverityFinding",
+                                "shortDescription": {
+                                    "text": "High severity security finding"
+                                },
+                            },
+                            {
+                                "id": "TRACESHIELD-MEDIUM",
+                                "name": "MediumSeverityFinding",
+                                "shortDescription": {
+                                    "text": "Medium severity security finding"
+                                },
+                            },
+                            {
+                                "id": "TRACESHIELD-LOW",
+                                "name": "LowSeverityFinding",
+                                "shortDescription": {
+                                    "text": "Low severity security finding"
+                                },
+                            },
+                        ],
+                    }
+                },
+                "results": results,
+            }
+        ],
+    }
+    return json.dumps(sarif, indent=2)
+
+
+def format_junit(findings: list[FindingOutput], scan: ScanStatusOutput) -> str:
+    has_high = any(f.severity == "high" for f in findings)
+    has_medium = any(f.severity == "medium" for f in findings)
+
+    test_count = scan.total_tests
+    failure_count = len(findings)
+    error_count = 1 if has_high else 0
+
+    lines = [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        f'<testsuite name="Orithos" tests="{test_count}" failures="{failure_count}" errors="{error_count}" skipped="0">',
+    ]
+
+    for f in findings:
+        verdict = "failure" if f.severity in ("high", "medium") else "pass"
+        name = html.escape(f.attack_path)
+        msg = html.escape(f.attack_path)
+        rec = html.escape(f.recommendation)
+        lines.append(
+            f'  <testcase classname="scan.{scan.id}" name="{name}" {verdict}="{f.severity}">'
+        )
+        if verdict == "failure":
+            lines.append(f'    <{f.severity} message="{msg}">{rec}</{f.severity}>')
+        lines.append("  </testcase>")
+
+    lines.append("</testsuite>")
+    return "\n".join(lines)

orithos_cli/probes.py

@@ -0,0 +1,50 @@
+"""Probe catalog subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="probes")
+def probes_group() -> None:
+    """List available security probes."""
+    pass
+
+
+@probes_group.command("list")
+@click.option("--category", default=None, help="Filter by attack category")
+@click.option("--tag", default=None, help="Filter by compliance tag")
+@click.option("--limit", default=30, help="Max results (default: 30)")
+def list_probes(category: str | None, tag: str | None, limit: int) -> None:
+    """List available security probes from the probe catalog."""
+    cfg = get_config()
+    params = {}
+    if category:
+        params["category"] = category
+    if tag:
+        params["tag"] = tag
+    try:
+        resp = httpx.get(f"{cfg.api_url}/v1/probes", params=params, headers=cfg.auth_headers(), timeout=cfg.timeout)
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        click.echo(f"Error: {exc.response.status_code} — {exc.response.text}", err=True)
+        raise SystemExit(1)
+    except Exception as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+    data = resp.json()
+    items = data if isinstance(data, list) else data.get("items", [])
+    if not items:
+        click.echo("No probes found.")
+        return
+    click.echo(f"Probes ({len(items)} shown):")
+    for p in items[:limit]:
+        name = p.get("name", p.get("probe_key", "?"))
+        cat = p.get("category", p.get("attack_category", "?"))
+        severity = p.get("severity", p.get("severity_base", "?"))
+        sev_color = {"critical": "red", "high": "yellow", "medium": "blue", "low": "green"}.get(severity, "white")
+        click.secho(f"  [{severity.upper()}] {name}", fg=sev_color)
+        click.echo(f"         Category: {cat}")

orithos_cli/remediation.py

@@ -0,0 +1,111 @@
+"""Remediation subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import json
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="remediation")
+def remediation_group() -> None:
+    """Generate, verify, apply, and commit AI security remediations."""
+    pass
+
+
+@remediation_group.command("generate")
+@click.argument("finding-id")
+def generate_remediation(finding_id: str) -> None:
+    """Generate a remediation fix for a finding.
+
+    FINDING_ID is the UUID of the finding to remediate.
+    """
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/remediation/generate"
+    resp = httpx.post(url, json={"finding_id": finding_id}, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    click.echo(json.dumps(data, indent=2))
+    if "remediation_id" in data:
+        click.echo(f"\nRemediation ID: {data['remediation_id']}")
+        click.echo(f"Type: {data.get('type', 'unknown')}")
+        if data.get("verification_probe"):
+            click.echo(f"Verification probe: {data['verification_probe'][:100]}...")
+        if data.get("expected_after_fix"):
+            click.echo(f"Expected after fix: {data['expected_after_fix'][:100]}...")
+
+
+@remediation_group.command("verify")
+@click.argument("remediation-id")
+def verify_remediation(remediation_id: str) -> None:
+    """Run the verification probe against the live agent.
+
+    REMEDIATION_ID is the UUID of the remediation to verify.
+    """
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/remediation/{remediation_id}/verify"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    status = data.get("verification_status", "unknown")
+    color = "green" if status == "resolved" else ("yellow" if status == "partial" else "red")
+    click.secho(f"Verification status: {status}", fg=color)
+    if data.get("details"):
+        click.echo(f"Details: {data['details'][:500]}")
+
+
+@remediation_group.command("apply")
+@click.argument("remediation-id")
+def apply_remediation(remediation_id: str) -> None:
+    """Mark a remediation as applied (user has implemented the patch)."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/remediation/{remediation_id}/apply"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    click.echo("Remediation marked as applied.")
+
+
+@remediation_group.command("commit")
+@click.argument("remediation-id")
+@click.option("--repo", required=True, help="GitHub repo URL (e.g. https://github.com/org/repo)")
+@click.option("--branch", default="main", help="Target branch (default: main)")
+@click.option("--token", envvar="GITHUB_TOKEN", required=True, help="GitHub personal access token")
+def commit_remediation(remediation_id: str, repo: str, branch: str, token: str) -> None:
+    """Create a GitHub PR with the remediation patch applied.
+
+    REMEDIATION_ID is the UUID of the remediation to commit.
+    """
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/remediation/{remediation_id}/commit"
+    resp = httpx.post(
+        url,
+        json={"repo_url": repo, "branch": branch, "github_token": token},
+        headers=cfg.auth_headers(),
+        timeout=cfg.timeout,
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    click.secho("✅ PR created successfully!", fg="green")
+    click.echo(f"PR URL: {data.get('pr_url', 'N/A')}")
+    click.echo(f"PR Number: {data.get('pr_number', 'N/A')}")
+    click.echo(f"Branch: {data.get('branch', 'N/A')}")
+
+
+@remediation_group.command("list")
+@click.argument("finding-id")
+def list_remediations(finding_id: str) -> None:
+    """List all remediations for a finding."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/remediation/finding/{finding_id}"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    if not data:
+        click.echo("No remediations found for this finding.")
+        return
+    for r in data:
+        click.secho(f"[{r.get('remediation_type', '?')}] {r['id'][:8]}", bold=True)
+        click.echo(f"  Status: {r.get('status', '?')}  Verification: {r.get('verification_status', 'untested')}")
+        click.echo(f"  Created: {r.get('created_at', '?')}")

orithos_cli/runtime.py

@@ -0,0 +1,100 @@
+"""Runtime evaluation and alerting subcommands for Orithos CLI."""
+
+from __future__ import annotations
+
+import click
+import httpx
+
+from orithos_cli.config import get_config
+
+
+@click.group(name="runtime")
+def runtime_group() -> None:
+    """Evaluate agent outputs and manage runtime alerts."""
+    pass
+
+
+@runtime_group.command("evaluate")
+@click.option("--prompt", required=True, help="The user prompt sent to the agent")
+@click.option("--response", required=True, help="The agent's response text")
+@click.option("--agent-id", default=None, help="Optional agent ID for context")
+def evaluate_output(prompt: str, response: str, agent_id: str | None) -> None:
+    """Evaluate a prompt+response pair against active guardrails."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/runtime/evaluate"
+    payload = {"prompt": prompt, "response": response}
+    if agent_id:
+        payload["agent_id"] = agent_id
+    resp = httpx.post(url, json=payload, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    verdict_color = {"allow": "green", "review": "yellow", "block": "red"}.get(data.get("verdict", ""), "white")
+    click.secho(f"Verdict: {data.get('verdict', 'unknown')}", bold=True, fg=verdict_color)
+    click.echo(f"Severity: {data.get('severity', 'unknown')}")
+    if data.get("violated_rules"):
+        click.echo(f"Violated rules: {', '.join(data['violated_rules'])}")
+    if data.get("reason"):
+        click.echo(f"Reason: {data['reason']}")
+
+
+@click.group(name="alerting")
+def alerting_group() -> None:
+    """Manage alerting rules and view anomaly events."""
+    pass
+
+
+@alerting_group.command("rules")
+@click.option("--list", "list_rules", is_flag=True, help="List all alert rules")
+def list_alert_rules(list_rules: bool) -> None:
+    """List or manage alert rules."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/alerting/rules"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    if not data:
+        click.echo("No alert rules configured.")
+        return
+    for r in data:
+        enabled_color = "green" if r.get("enabled") else "red"
+        click.secho(f"[{'ON' if r.get('enabled') else 'OFF'}] {r['name']}", fg=enabled_color)
+        click.echo(f"  Type: {r.get('rule_type', '?')}  ID: {r['id'][:8]}")
+        if r.get("last_triggered_at"):
+            click.echo(f"  Last triggered: {r['last_triggered_at']}")
+
+
+@alerting_group.command("evaluate")
+def evaluate_alert_rules() -> None:
+    """Evaluate all enabled alert rules and fire notifications."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/alerting/evaluate"
+    resp = httpx.post(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    triggered = data.get("triggered", [])
+    if triggered:
+        click.secho(f"{len(triggered)} rule(s) triggered:", bold=True, fg="yellow")
+        for t in triggered:
+            click.echo(f"  {t.get('name', '?')} ({t.get('type', '?')})")
+    else:
+        click.echo("No rules triggered.")
+
+
+@alerting_group.command("anomalies")
+@click.option("--limit", default=20, help="Max results (default: 20)")
+def list_anomalies(limit: int) -> None:
+    """List recent anomaly events."""
+    cfg = get_config()
+    url = f"{cfg.api_url}/v1/alerting/anomalies?limit={limit}"
+    resp = httpx.get(url, headers=cfg.auth_headers(), timeout=cfg.timeout)
+    resp.raise_for_status()
+    data = resp.json()
+    items = data.get("items", [])
+    if not items:
+        click.echo("No anomalies detected.")
+        return
+    for a in items:
+        sev_color = {"critical": "red", "high": "yellow", "medium": "blue"}.get(a.get("severity", ""), "white")
+        click.secho(f"[{a.get('severity', '?').upper()}] {a.get('anomaly_type', '?')}", fg=sev_color)
+        click.echo(f"  {a.get('description', '')[:120]}")
+        click.echo(f"  {a.get('created_at', '')}")