bicep_analyze
Analyze Azure Bicep code to assess NIST 800-53 compliance, identify security gaps, and calculate FedRAMP/IL4 readiness score.
Instructions
Analyze Azure Bicep IaC code for NIST 800-53 Rev 5 compliance coverage. Returns controls addressed, gaps, security findings, and overall FedRAMP/IL4 readiness score.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| bicepCode | Yes | The Bicep code to analyze | |
| targetLevel | No | Compliance target level (default: fedramp-high) |
Implementation Reference
- Main handler function for bicep_analyze. Validates input via Zod schema, calls the external site API with bicepCode and targetLevel, and formats the analysis result as a markdown string.
export async function handleBicepAnalyze(args: unknown): Promise<string> { return runTool('bicep_analyze', args, Schema, async ({ bicepCode, targetLevel }) => { const data = (await callSiteApi('/api/bicep-analyze', { bicepCode, targetLevel, })) as AnalysisResult; return formatAnalysis(data, targetLevel ?? 'fedramp-high'); }); } - Zod validation schema for bicep_analyze: bicepCode (required, 1-20000 chars) and targetLevel (optional enum, defaults to fedramp-high).
const Schema = z.object({ bicepCode: z.string().min(1).max(20000), targetLevel: z .enum(['fedramp-moderate', 'fedramp-high', 'il4', 'il5']) .default('fedramp-high'), }); - src/tools/index.ts:60-87 (registration)Tool dispatch registration: routes the 'bicep_analyze' tool name to handleBicepAnalyze in the main tool handler switch statement.
export async function handleToolCall(name: string, args: unknown): Promise<string> { switch (name) { case 'bicep_analyze': return handleBicepAnalyze(args); case 'bicep_remediate': return handleBicepRemediate(args); case 'control_lookup': return handleControlLookup(args); case 'control_narrative': return handleControlNarrative(args); case 'poam_generate': return handlePoamGenerate(args); case 'ato_readiness': return handleAtoReadiness(args); case 'oscal_fragment': return handleOscalFragment(args); case 'landing_zone_design': return handleLandingZone(args); case 'landing_zone_reference': return handleLandingZoneReference(args); case 'azure_service_selector': return handleServiceSelect(args); case 'gcc_high_guidance': return handleGccHigh(args); case 'private_endpoint_map': return handlePrivateEndpoint(args); case 'bigbang_validate': return handleBigbangValidate(args); case 'bigbang_harden': return handleBigbangHarden(args); case 'ironbank_lookup': return handleIronbankLookup(args); case 'addon_configurator': return handleAddonConfigurator(args); case 'pipeline_audit': return handlePipelineAudit(args); case 'signing_config': return handleSigningConfig(args); case 'devsecops_scorecard': return handleDevsecopsScorecard(args); case 'ssp_section': return handleSspSection(args); case 'contingency_plan': return handleContingencyPlan(args); case 'govcloud_quickstart': return handleGovcloudQuickstart(args); default: throw new Error(`Unknown tool: ${name}`); } } - src/tools/index.ts:29-31 (registration)Tool list registration: bicepAnalyzeTool is included in the allTools array that populates the MCP server's tool list.
export const allTools = [ // Compliance bicepAnalyzeTool, - Helper function that formats the AnalysisResult (controls covered/partial/missing, security findings, overall score) into a markdown table for the MCP response.
function formatAnalysis(data: AnalysisResult, targetLevel: string): string { const { controlsCovered, controlsPartial, controlsMissing, securityFindings, overallScore } = data; const lines: string[] = []; lines.push(`## Bicep Compliance Analysis — ${targetLevel.toUpperCase()}`); lines.push(''); lines.push(`### Overall Score: ${overallScore.score}/100 — ${overallScore.fedrampReadiness}`); lines.push(`**IL4 Ready:** ${overallScore.il4Ready ? 'Yes ✓' : 'No ✗'}`); lines.push(''); lines.push(`> ${overallScore.summary}`); lines.push(''); if (controlsCovered.length > 0) { lines.push(`### Controls Addressed (${controlsCovered.length})`); lines.push(''); lines.push('| Control ID | Control Name | Azure Service |'); lines.push('|-----------|-------------|--------------|'); for (const c of controlsCovered) { lines.push(`| ${c.controlId} | ${c.controlName} | ${c.azureService ?? '—'} |`); } lines.push(''); } if (controlsPartial.length > 0) { lines.push(`### Partial Controls — Gaps Present (${controlsPartial.length})`); lines.push(''); lines.push('| Control ID | Gap | Remediation | Severity |'); lines.push('|-----------|-----|-------------|----------|'); for (const c of controlsPartial) { lines.push(`| ${c.controlId} | ${c.gap ?? '—'} | ${c.remediation ?? '—'} | ${c.severity ?? '—'} |`); } lines.push(''); } if (controlsMissing.length > 0) { const critical = controlsMissing.filter((c) => c.severity === 'critical'); const others = controlsMissing.filter((c) => c.severity !== 'critical'); if (critical.length > 0) { lines.push(`### Missing Controls — Critical (${critical.length})`); lines.push(''); lines.push('| Control ID | Control Name | Reason | Remediation |'); lines.push('|-----------|-------------|--------|-------------|'); for (const c of critical) { lines.push(`| ${c.controlId} | ${c.controlName} | ${c.reason ?? '—'} | ${c.remediation ?? '—'} |`); } lines.push(''); } if (others.length > 0) { lines.push(`### Missing Controls — Other (${others.length})`); lines.push(''); lines.push('| Control ID | Control Name | Severity | Remediation |'); lines.push('|-----------|-------------|----------|-------------|'); for (const c of others) { lines.push(`| ${c.controlId} | ${c.controlName} | ${c.severity ?? '—'} | ${c.remediation ?? '—'} |`); } lines.push(''); } } if (securityFindings.length > 0) { lines.push(`### Security Findings (${securityFindings.length})`); lines.push(''); lines.push('| Severity | Finding | Affected Resource | Fix |'); lines.push('|----------|---------|------------------|-----|'); for (const f of securityFindings) { lines.push(`| ${f.severity.toUpperCase()} | ${f.finding} | ${f.affectedResource} | ${f.fix} |`); } lines.push(''); } return lines.join('\n'); }