MCP安全增强服务

Google's MCP Server (baseline)
        ↓
Secure Wrapper (src/secure-index.ts)
        ↓
Security Orchestrator
        ↓
├─ ABAC Policy Engine
├─ Input Validator (prompt injection)
├─ Model Armor (PII detection)
├─ OTel Audit Logging
└─ SIEM Integration

# Install dependencies
npm install

# Generate mTLS certificates
cd security-layer/mtls
./generate-certs.sh

# Configure environment
cp .env.example .env
# Edit .env with your credentials

# Run server
npm run dev

# Run all tests
npm test

# Run tests with UI
npm run test:ui

# Coverage
npm run test:run

secure-mcp-auth-demo/
├── src/
│   └── secure-index.ts          # Main secure wrapper
├── security-layer/
│   ├── audit-logging/           # OTel + SIEM
│   ├── mtls/                    # Certs + ABAC
│   ├── model-armor/             # PIi-cloud/             # Cloud portability
├── google-baseline/             # Google's MCP (submodule)
├── docs/
│   ├── threat-model.md          # Security analysis
│   ├── security-gaps.md         # Before/after comparison
│   └── architecture.md          # Design decisions
└── tests/
    ├── unit/                    # Component tests
    └── integration/             # E2E security flows

# Chronicle (Google SecOps)
CHRONICLE_ENDPOINT=https://...

# Splunk HEC
SPLUNK_HEC_ENDPOINT=https://...
SPLUNK_HEC_TOKEN=...

# Elastic
ELASTIC_ENDPOINT=https://...

{
  "id": "policy-admin",
  "agents": ["admin-agent"],
  "tools": ["*"],
  "conditions": {
    "trustLevel": ["high"],
    "rateLimit": { "requests": 1000, "windowMs": 60000 }
  }
}