DevSecOps安全测试服务器

src/
├── mcp/
│   ├── server.ts           # Main MCP server
│   ├── tools/
│   │   ├── sast-tool.ts    # SAST integration
│   │   ├── dast-tool.ts    # DAST integration  
│   │   ├── iast-tool.ts    # IAST integration
│   │   └── sca-tool.ts     # SCA integration
│   └── connectors/
│       ├── sonarqube.ts
│       ├── zap.ts
│       ├── trivy.ts
│       └── osv-scanner.ts
├── config/
│   ├── security-rules.yml
│   └── tool-configs.json
└── tests/security/

# SAST tools
pip3 install semgrep bandit

# DAST tools (Docker)
docker pull owasp/zap2docker-stable

# SCA tools (npm audit is included with Node.js)
# OSV Scanner (optional)
wget -qO- https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64.tar.gz | tar -xz -C /usr/local/bin

# Trivy (optional)  
wget -qO- https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh

{
  "name": "devsecops-mcp-server",
  "command": "node dist/src/mcp/server.js",
  "args": [],
  "capabilities": ["tools"]
}

# Copy environment template
cp .env.example .env

# Edit with your configuration
nano .env

# Server Configuration
NODE_ENV=production
MCP_PORT=3000
SECURITY_STRICT_MODE=true

# Tool Configuration
SONARQUBE_TOKEN=your-token
ZAP_API_KEY=your-key
OSV_SCANNER_PATH=osv-scanner
TRIVY_PATH=trivy
TRIVY_CACHE_DIR=/tmp/trivy-cache

{
  "name": "run_sast_scan",
  "description": "Execute SAST security scan",
  "inputSchema": {
    "target": "string",           // Source code path/repo
    "rules": "array",             // Security rules
    "severity_threshold": "enum", // low|medium|high|critical
    "tool": "enum"                // sonarqube|semgrep|auto
  }
}

{
  "name": "run_dast_scan",
  "description": "Execute DAST security scan",
  "inputSchema": {
    "target_url": "string",       // Application URL
    "scan_type": "enum",          // quick|baseline|full
    "authentication": "object"    // Login credentials
  }
}

{
  "name": "run_sca_scan",
  "description": "Execute SCA dependency scan",
  "inputSchema": {
    "project_path": "string",     // Project directory
    "package_manager": "enum",    // npm|yarn|maven|gradle|pip
    "tool": "enum",               // osv-scanner|trivy|npm-audit|auto
    "fix_vulnerabilities": "bool" // Auto-fix enabled
  }
}

{
  "name": "run_iast_scan",
  "description": "Execute IAST-like security analysis",
  "inputSchema": {
    "application_id": "string",   // App identifier or path
    "environment": "enum",        // dev|staging|testing
    "tool": "enum",               // trivy|owasp-zap|auto
    "test_suite": "string"        // Test suite to run (optional)
  }
}

{
  "name": "generate_security_report",
  "description": "Generate comprehensive security report",
  "inputSchema": {
    "scan_ids": "array",          // Scan result IDs
    "format": "enum",             // json|html|pdf|sarif
    "include_remediation": "bool" // Include fix guidance
  }
}

{
  "name": "validate_security_policy",
  "description": "Validate security policy compliance",
  "inputSchema": {
    "policy_file": "string",      // Policy file path
    "scan_results": "array"       // Scan result IDs
  }
}

# Comprehensive security test (actually verified)
node test-all-security.js

# SAST testing
node test-sast.js

# DAST testing with vulnerable web server
node test-vulnerable-server.js &
curl "http://localhost:3001/search?q=<script>alert('XSS')</script>"

# Unit tests
npm test

# With coverage
npm run test:coverage

# Integration tests
npm run test:integration

# 1. Verify security tools installation
semgrep --version
bandit --version

# 2. Test immediately with provided vulnerable samples
semgrep --config=auto --json test-samples/vulnerable-app.js
# Result: 7 vulnerabilities detected (SQL Injection, XSS, Command Injection, etc.)

bandit -f json test-samples/vulnerable-app.py  
# Result: 19 issues found (4 high-risk)

# 3. Scan vulnerable dependencies
cd test-vulnerable-dependencies && npm audit
# Result: 20 vulnerabilities (critical: 4, high: 10)

curl -X POST http://localhost:3000/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "method": "tools/call",
    "params": {
      "name": "run_sast_scan",
      "arguments": {
        "target": "/path/to/source",
        "severity_threshold": "high"
      }
    }
  }'

# 1. SAST Analysis
curl -X POST http://localhost:3000/mcp \
  -d '{"method": "tools/call", "params": {"name": "run_sast_scan", "arguments": {"target": "/src"}}}'

# 2. Dependency Scan
curl -X POST http://localhost:3000/mcp \
  -d '{"method": "tools/call", "params": {"name": "run_sca_scan", "arguments": {"project_path": "/src"}}}'

# 3. Dynamic Testing
curl -X POST http://localhost:3000/mcp \
  -d '{"method": "tools/call", "params": {"name": "run_dast_scan", "arguments": {"target_url": "https://app.example.com"}}}'

# 4. Generate Report
curl -X POST http://localhost:3000/mcp \
  -d '{"method": "tools/call", "params": {"name": "generate_security_report", "arguments": {"scan_ids": ["sast-123", "sca-456", "dast-789"], "format": "html"}}}'

#!/bin/bash
# .git/hooks/pre-commit
git-secrets --scan
semgrep --config=auto --error
npm audit --audit-level high
osv-scanner --lockfile=package-lock.json .
trivy fs --exit-code 1 --severity HIGH,CRITICAL .

# .github/workflows/security.yml
security_scan:
  runs-on: ubuntu-latest
  steps:
    - name: SAST Scan
      run: |
        curl -X POST $MCP_SERVER_URL/mcp \
          -d '{"method": "tools/call", "params": {"name": "run_sast_scan", "arguments": {"target": "."}}}'

curl http://localhost:3000/health

# Issue: pip3 permission error
# Solution:
pip3 install --user semgrep bandit

# Or with system permissions
sudo pip3 install semgrep bandit

# Issue: Strict type checking errors
# Temporary solution: Skip compilation and run with JavaScript
node test-all-security.js  # Test without TypeScript build

# Permanent solution: Fix tsconfig.json configuration

# Issue: No Docker execution permissions
# Solution:
sudo usermod -aG docker $USER
newgrp docker

# Issue: Ports 3000, 3001 already in use
# Solution:
export MCP_PORT=3002
node test-vulnerable-server.js  # Use different port

# Issue: node-sass compilation error
# Solution: Install excluding problematic packages
cd test-vulnerable-dependencies
npm install --ignore-engines

# Setup and test in under 5 minutes
pip3 install semgrep bandit
git clone <repo> && cd DevSecOps-MCP
node test-all-security.js