egovframe-scaffold-mcp

보안약점 점검 (개발보안 가이드)

check_egovframe_secure_coding

Idempotent

Scans eGovFrame source for secure coding weaknesses like SQL injection, XSS, and hardcoded secrets, then reports findings with CWE, severity, and SARIF output for code scanning.

Instructions

행정안전부·KISA 「소프트웨어 개발보안 가이드」(2021) 구현단계 보안약점 중 정적 패턴으로 오탐을 통제할 수 있는 항목을 소스에서 찾습니다 — SQL 삽입(MyBatis ${…}·iBATIS $…$·JDBC 문자열 연결), 크로스사이트 스크립트(요청 값·EL param/header/cookie 무이스케이프 출력, <c:out escapeXml="false">), 경로 조작, 신뢰되지 않는 URL 자동접속, 운영체제 명령어, XML 외부개체, 취약한 해시·암호, 보안 문맥의 부적절한 난수, 코드·설정의 하드코드된 중요정보, HttpOnly·Secure 없는 쿠키, printStackTrace, 빈 catch, 역직렬화, 남은 디버그 출력. 규칙은 catalog/secure-coding-rules.json 데이터이고 주석은 무시합니다. 항목마다 파일·라인·CWE·등급·조치와 출처(공통컴포넌트 원본·수정본·매니페스트 없음·프로젝트 코드·테스트)를 냅니다. 예외는 .egovframe-secure-ignore.json(사유·검토자 필수), baselinePath(이전 JSON 결과·SARIF)와 비교해 새 항목 표시, format=sarif 또는 sarifPath 로 SARIF 2.1.0(GitHub code scanning 등). v1.5: 메서드 안 데이터 흐름(요청 파라미터·헤더·쿠키·Spring 바인딩 값 → 대입·결합·append → JDBC·파일 경로·OS 명령·리다이렉트)으로 등급을 올리거나 내리고 변수를 거친 미탐을 찾습니다(메서드 간 흐름은 보지 않음). v1.7: HTMLTagFilter 가 등록돼 있으면(요청 값을 엔티티로 저장) c:out escapeXml="false" 를 낮음으로 보고 사유를 적습니다. 고칠 수 있는 항목은 fix_egovframe_secure_coding 으로. 패턴 기반 진단 보조이며 공인 진단을 대체하지 않습니다.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "projectDir": "<projectDir>"
    },
    "name": "check_egovframe_secure_coding"
  }
}

Input Schema

Name	Required	Description	Default
`top`	No	[deprecated 1.0.0 — topN 을 쓰세요, 2.0.0 에서 제거] Markdown 상세 항목 수
`topN`	No	Markdown 상세 항목 수(기본 40)
`paths`	No	프로젝트 상대 경로 접두어로 좁히기(예: src/main/java/egovframework/example)
`rules`	No	점검할 규칙 id(기본 전체)
`format`	No	응답 형식(sarif 는 SARIF 2.1.0 JSON 본문)	markdown
`dataFlow`	No	v1.5: 메서드 안 데이터 흐름 분석 — 요청 값이 SQL·파일 경로·OS 명령·리다이렉트 인자로 들어가면 등급을 올리고(경로를 note·flow·SARIF codeFlows 에), 상수만이면 내리며, 변수를 거친 흐름도 찾음. false 면 v1.4 까지의 패턴 판정만
`overwrite`	No	sarifPath 가 있으면 덮어쓰기
`sarifPath`	No	SARIF 2.1.0 을 쓸 프로젝트 상대 경로(예: egovframe-secure.sarif)
`projectDir`	Yes	프로젝트 디렉터리(절대경로 권장) — 읽기만 함
`maxFindings`	No	응답에 담을 최대 항목 수(SARIF 파일에는 전부)
`baselinePath`	No	이전 결과(format=json 출력 또는 SARIF, 프로젝트 상대 경로) — 새로 생긴 항목만 표시
`includeTests`	No	src/test 도 점검(등급은 낮음으로)

Output Schema

Name	Required	Description	Default
`notes`	Yes
`sarif`	No
`byRule`	Yes
`summary`	Yes
`baseline`	No
`byModule`	No
`byOrigin`	Yes
`byTarget`	Yes
`dataFlow`	No
`findings`	Yes
`truncated`	Yes
`disclaimer`	Yes
`projectDir`	Yes
`filesScanned`	Yes
`rulesVersion`	Yes
`suppressions`	Yes
`htmlTagFilter`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv1.9.0Oct 29, 2026
- addedOutput schema / properties / htmlTagFilter
```
Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}
```
Changed60 schema fields changedv1.6.0Oct 26, 2026
- removedInput schema / additionalProperties
```
Removed value: -false
```
- addedInput schema / properties / dataFlow
```
Added value: +{
+  "default": true,
+  "description": "v1.5: 메서드 안 데이터 흐름 분석 — 요청 값이 SQL·파일 경로·OS 명령·리다이렉트 인자로 들어가면 등급을 올리고(경로를 note·flow·SARIF codeFlows 에), 상수만이면 내리며, 변수를 거친 흐름도 찾음. false 면 v1.4 까지의 패턴 판정만",
+  "type": "boolean"
+}
```
- changedOutput schema / properties / baseline / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / baseline / properties / findings / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / baseline / properties / findings / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / baseline / properties / resolved / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / baseline / properties / resolved / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / byModule / items / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / byModule / items / properties / high / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / high / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / low / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / low / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / medium / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / medium / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / total / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byModule / items / properties / total / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byOrigin / additionalProperties / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byOrigin / additionalProperties / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byOrigin / propertyNames
```
Added value: +{
+  "type": "string"
+}
```
- changedOutput schema / properties / byRule / items / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / byRule / items / properties / count / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byRule / items / properties / count / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byTarget / additionalProperties / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / byTarget / additionalProperties / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / byTarget / propertyNames
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / dataFlow
```
Added value: +{
+  "additionalProperties": {},
+  "properties": {
+    "constant": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "detected": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "enabled": {
+      "type": "boolean"
+    },
+    "tainted": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    },
+    "unknown": {
+      "maximum": 9007199254740991,
+      "minimum": -9007199254740991,
+      "type": "integer"
+    }
+  },
+  "required": [
+    "enabled",
+    "tainted",
+    "constant",
+    "unknown",
+    "detected"
+  ],
+  "type": "object"
+}
```
- addedOutput schema / properties / filesScanned / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / filesScanned / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / findings / items / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / findings / items / properties / column / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / findings / items / properties / column / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / findings / items / properties / cwe / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / findings / items / properties / cwe / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / findings / items / properties / flow
```
Added value: +{
+  "additionalProperties": {},
+  "properties": {
+    "detected": {
+      "type": "boolean"
+    },
+    "method": {
+      "type": "string"
+    },
+    "path": {
+      "items": {
+        "additionalProperties": {},
+        "properties": {
+          "code": {
+            "type": "string"
+          },
+          "line": {
+            "maximum": 9007199254740991,
+            "minimum": -9007199254740991,
+            "type": "integer"
+          },
+          "step": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "line",
+          "code",
+          "step"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "status": {
+      "enum": [
+        "tainted",
+        "constant",
+        "unknown"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "status",
+    "method",
+    "path"
+  ],
+  "type": "object"
+}
```
- addedOutput schema / properties / findings / items / properties / line / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / findings / items / properties / line / minimum
```
Added value: +-9007199254740991
```
- removedOutput schema / properties / findings / items / properties / severity / $ref
```
Removed value: -"#/properties/byRule/items/properties/severity"
```
- addedOutput schema / properties / findings / items / properties / severity / enum
```
Added value: +[
+  "high",
+  "medium",
+  "low"
+]
```
- addedOutput schema / properties / findings / items / properties / severity / type
```
Added value: +"string"
```
- changedOutput schema / properties / rulesVersion / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / rulesVersion / properties / rules / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / rulesVersion / properties / rules / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / sarif / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / sarif / properties / results / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / sarif / properties / results / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / summary / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / summary / properties / high / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / summary / properties / high / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / summary / properties / low / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / summary / properties / low / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / summary / properties / medium / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / summary / properties / medium / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / summary / properties / new / anyOf
```
Previous value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "maximum": 9007199254740991,
+    "minimum": -9007199254740991,
+    "type": "integer"
+  },
+  {
+    "type": "null"
+  }
+]
```
- addedOutput schema / properties / summary / properties / suppressed / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / summary / properties / suppressed / minimum
```
Added value: +-9007199254740991
```
- addedOutput schema / properties / summary / properties / total / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / summary / properties / total / minimum
```
Added value: +-9007199254740991
```
- changedOutput schema / properties / suppressions / additionalProperties
```
Previous value: -trueNew value: +{}
```
- addedOutput schema / properties / suppressions / properties / applied / maximum
```
Added value: +9007199254740991
```
- addedOutput schema / properties / suppressions / properties / applied / minimum
```
Added value: +-9007199254740991
```

Changed4 schema fields changedv0.47.0Oct 16, 2026

removedInput schema / properties / top / default
```
Removed value: -40
```

changedInput schema / properties / top / description

Previous value: -"Markdown 상세 항목 수"New value: +"[deprecated 1.0.0 — topN 을 쓰세요, 2.0.0 에서 제거] Markdown 상세 항목 수"

addedInput schema / properties / topN

Added value: +{
+  "description": "Markdown 상세 항목 수(기본 40)",
+  "maximum": 500,
+  "minimum": 1,
+  "type": "integer"
+}

addedOutput schema / properties / byModule

Added value: +{
+  "items": {
+    "additionalProperties": true,
+    "properties": {
+      "high": {
+        "type": "integer"
+      },
+      "low": {
+        "type": "integer"
+      },
+      "medium": {
+        "type": "integer"
+      },
+      "module": {
+        "type": "string"
+      },
+      "total": {
+        "type": "integer"
+      }
+    },
+    "required": [
+      "module",
+      "high",
+      "medium",
+      "low",
+      "total"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Addedv0.45.0Oct 14, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses behavior well beyond annotations: comments are ignored, exceptions require reason/reviewer via .egovframe-secure-ignore.json, writes SARIF when sarifPath is set (consistent with readOnlyHint=false), and the intra-method-only data-flow limitation is stated explicitly. These operational details are exactly what the annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded, but the description is a very dense wall of text with a long inline enumeration of rule categories and version-history notes (v1.5, v1.7) that increase cognitive load. Most content earns its place, but the density hurts scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Complete for a 12-parameter tool: output schema and 100% schema coverage handle the return/param surface, and the description covers exceptions, baseline diffing, SARIF export, and analytical limitations. Nothing needed to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: the v1.5 paragraph elaborates what dataFlow=true does (raises/lowers grades, finds flows through variables, not inter-method) and explains baselinePath accepts prior JSON or SARIF. Adds value beyond the schema's field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (소스에서 찾습니다) and resource (구현단계 보안약점) and enumerates the concrete vulnerability classes it detects (SQL 삽입, XSS, 경로 조작, etc.). It is clearly a static security-pattern scanner, readily distinguished from the sibling fix_egovframe_secure_coding which it explicitly references for remediation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Routes fixable findings to fix_egovframe_secure_coding and frames itself as '패턴 기반 진단 보조이며 공인 진단을 대체하지 않습니다', which is a clear scope/limitation caveat. It does not explicitly contrast against other diagnostics like diagnose_egovframe_project, so silent-vs-silent selection is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server