HIPAA Guardian MCP Server

Implementation Reference

• server.ts:304-322 (handler)

  The handler function that executes the tool logic, returning a static text response containing the OWASP-based API security checklist.

      async () => {
          return {
              content: [{
                  type: 'text',
                  text: `
  # General API Security Checklist (OWASP Based)
  
  1.  **Authentication:** Implement a standard, strong authentication mechanism (e.g., OAuth 2.0, JWT). Do not roll your own.
  2.  **Authorization:** Enforce authorization at every endpoint. Check that the authenticated user has the correct permissions to perform the requested action on the requested resource (e.g., User A cannot access User B's data).
  3.  **Input Validation:** Validate all incoming data for type, format, and length. Reject any invalid data. This protects against injection attacks.
  4.  **Rate Limiting:** Implement rate limiting to protect against denial-of-service (DoS) and brute-force attacks.
  5.  **Use HTTPS Everywhere:** All API endpoints must enforce TLS 1.2 or higher.
  6.  **Proper Error Handling:** Return generic error messages. Do not leak sensitive information like stack traces or internal function names.
  7.  **Security Headers:** Use security headers like Content-Security-Policy, Strict-Transport-Security, and X-Content-Type-Options.
  8.  **Logging and Monitoring:** Log all API requests and monitor for suspicious activity, such as high error rates or access attempts from unusual locations.
  `
              }]
          };
      }

• server.ts:302-302 (schema)

  The Zod schema for the tool input, defined as an empty object indicating no parameters are required.

  schema: z.object({}),

• server.ts:298-323 (registration)

  The server.tool() call that registers the 'getApiSecurityChecklist' tool, including its description, schema, and inline handler function.

  server.tool(
      'getApiSecurityChecklist',
      {
          description: 'Provides a general-purpose checklist for securing backend APIs, based on OWASP best practices.',
          schema: z.object({}),
      },
      async () => {
          return {
              content: [{
                  type: 'text',
                  text: `
  # General API Security Checklist (OWASP Based)
  
  1.  **Authentication:** Implement a standard, strong authentication mechanism (e.g., OAuth 2.0, JWT). Do not roll your own.
  2.  **Authorization:** Enforce authorization at every endpoint. Check that the authenticated user has the correct permissions to perform the requested action on the requested resource (e.g., User A cannot access User B's data).
  3.  **Input Validation:** Validate all incoming data for type, format, and length. Reject any invalid data. This protects against injection attacks.
  4.  **Rate Limiting:** Implement rate limiting to protect against denial-of-service (DoS) and brute-force attacks.
  5.  **Use HTTPS Everywhere:** All API endpoints must enforce TLS 1.2 or higher.
  6.  **Proper Error Handling:** Return generic error messages. Do not leak sensitive information like stack traces or internal function names.
  7.  **Security Headers:** Use security headers like Content-Security-Policy, Strict-Transport-Security, and X-Content-Type-Options.
  8.  **Logging and Monitoring:** Log all API requests and monitor for suspicious activity, such as high error rates or access attempts from unusual locations.
  `
              }]
          };
      }
  );