codecrucible-synth/dist/core/security/mcp-security-validator.d.ts

Production-Ready AI Development Platform with Multi-Voice Synthesis, Smithery MCP Integration, Enterprise Security, and Zero-Timeout Reliability

/**
 * MCP Security Validator (ENHANCED)
 * Implements 2024 MCP security best practices including OAuth Resource Server patterns,
 * sandboxing, rate limiting, and AI-specific threat detection
 *
 * Based on 2024 research findings:
 * - 29.5% of Python and 24.2% of JavaScript snippets contain security weaknesses
 * - OAuth Resource Server classification required for MCP servers
 * - Multi-agent red teaming for security validation
 */
import { EventEmitter } from 'events';
export interface MCPSecurityConfig {
    enableOAuth: boolean;
    requireResourceIndicators: boolean;
    jwtValidation: {
        enabled: boolean;
        issuer?: string;
        audience?: string;
        algorithms: string[];
    };
    sandboxing: {
        enabled: boolean;
        containerized: boolean;
        readOnlyFilesystem: boolean;
        networkIsolation: boolean;
        resourceLimits: {
            maxMemoryMB: number;
            maxCpuPercent: number;
            maxFileSize: number;
        };
    };
    rateLimiting: {
        enabled: boolean;
        requestsPerMinute: number;
        burstLimit: number;
        toolSpecificLimits: Map<string, number>;
    };
    monitoring: {
        logAllActions: boolean;
        enableThreatDetection: boolean;
        suspiciousPatternThreshold: number;
        humanApprovalRequired: string[];
    };
}
export interface MCPSecurityContext {
    sessionId: string;
    userId?: string;
    clientId: string;
    accessToken?: string;
    resourceIndicator?: string;
    ipAddress?: string;
    userAgent?: string;
    timestamp: number;
}
export interface MCPToolRequest {
    toolName: string;
    parameters: any;
    context: MCPSecurityContext;
    riskLevel: 'low' | 'medium' | 'high' | 'critical';
}
export interface SecurityValidationResult {
    allowed: boolean;
    reason?: string;
    requiresApproval?: boolean;
    modifiedParameters?: any;
    securityWarnings: string[];
    threatScore: number;
}
declare class MCPSecurityValidator extends EventEmitter {
    private config;
    private rateLimiter;
    private inputSanitizer;
    private suspiciousPatterns;
    private approvalQueue;
    constructor(config: MCPSecurityConfig);
    /**
     * Validates MCP tool request according to 2024 security best practices
     */
    validateToolRequest(request: MCPToolRequest): Promise<SecurityValidationResult>;
    /**
     * Validates OAuth Resource Server authentication per 2024 MCP spec
     */
    private validateAuthentication;
    /**
     * Tool-specific security validation
     */
    private validateToolSecurity;
    /**
     * Sanitizes and validates tool parameters
     */
    private sanitizeParameters;
    /**
     * Detects suspicious patterns using ML-inspired heuristics
     */
    private detectSuspiciousPatterns;
    /**
     * Determines if human approval is required
     */
    private requiresHumanApproval;
    /**
     * Path traversal detection
     */
    private detectPathTraversal;
    /**
     * Command injection detection
     */
    private detectCommandInjection;
    /**
     * Logs security events for monitoring
     */
    private logSecurityEvent;
    /**
     * Approves a request pending human review
     */
    approveRequest(requestId: string, approvedBy: string): Promise<boolean>;
    /**
     * Container-based sandboxing for MCP tool execution (2024 best practices)
     */
    createMCPSandbox(toolRequest: MCPToolRequest): Promise<{
        sandboxId: string;
        containerId?: string;
        resourceLimits: any;
        networkIsolation: boolean;
    }>;
    /**
     * Create Docker container for MCP tool isolation (2024 enterprise security)
     */
    private createDockerContainer;
    /**
     * Create process-based sandbox as fallback (2024 security)
     */
    private createProcessSandbox;
    /**
     * Validate sandbox execution results (2024 post-execution validation)
     */
    validateSandboxResult(sandboxId: string, result: any): Promise<{
        isValid: boolean;
        violations: string[];
        sanitizedResult: any;
    }>;
    /**
     * Cleanup sandbox resources (2024 resource management)
     */
    cleanupSandbox(sandboxId: string, containerId?: string): Promise<void>;
    /**
     * Gets security metrics (enhanced with sandbox metrics)
     */
    getSecurityMetrics(): {
        totalRequests: number;
        blockedRequests: number;
        pendingApprovals: number;
        avgThreatScore: number;
        topThreats: string[];
        sandboxingEnabled: boolean;
        containerizationEnabled: boolean;
        activeSandboxes: number;
    };
}
export declare const defaultMCPSecurityConfig: MCPSecurityConfig;
export { MCPSecurityValidator };
//# sourceMappingURL=mcp-security-validator.d.ts.map