validate_code_security

Instructions

Implementation Reference

• src/handlers/tools.ts:122-175 (handler)

  The main handler function `validateCodeSecurity` that executes the 'validate_code_security' tool. It takes code and language args, matches applicable security instructions, formats them with a header and rule listing, and returns the result.

  function validateCodeSecurity(
    args: Record<string, unknown>,
    instructions: Instruction[]
  ) {
    const code = args.code as string;
    const language = args.language as string;
    
    if (!code || !language) {
      return {
        content: [
          {
            type: 'text',
            text: 'Error: Both code and language are required',
          },
        ],
        isError: true,
      };
    }
    
    // Get applicable instructions
    const result = matchInstructions({ language }, instructions);
    
    // Build response with instructions and validation context
    const response = [
      `# Security Validation for ${language.toUpperCase()} Code`,
      '',
      `Analyzing the provided code against ${result.instructions.length} security rules...`,
      '',
      '## Applicable Security Rules:',
      '',
    ];
    
    result.instructions.forEach(i => {
      response.push(`### ${i.frontmatter.description}`);
      response.push('');
      response.push(i.content);
      response.push('');
      response.push('---');
      response.push('');
    });
    
    response.push('## Recommendation:');
    response.push('Review your code against the above security rules and ensure compliance.');
    
    return {
      content: [
        {
          type: 'text',
          text: response.join('\n'),
        },
      ],
      isError: false,
    };
  }

• src/handlers/tools.ts:35-51 (schema)

  Input schema definition for the 'validate_code_security' tool, declaring 'code' (string) and 'language' (string) as required parameters.

  {
    name: 'validate_code_security',
    description: 'Validate code snippet against security rules and return applicable instructions',
    inputSchema: {
      type: 'object',
      properties: {
        code: {
          type: 'string',
          description: 'Code snippet to validate',
        },
        language: {
          type: 'string',
          description: 'Programming language of the code',
        },
      },
      required: ['code', 'language'],
    },

• src/handlers/tools.ts:60-71 (registration)

  Registration/dispatch in `callTool` function: when name is 'validate_code_security', it calls the `validateCodeSecurity` function, connecting the MCP tool call to the handler.

  export function callTool(
    name: string,
    args: Record<string, unknown>,
    instructions: Instruction[]
  ) {
    if (name === 'get_security_instructions') {
      return getSecurityInstructions(args, instructions);
    }
    
    if (name === 'validate_code_security') {
      return validateCodeSecurity(args, instructions);
    }

• src/index.ts:111-115 (registration)

  MCP server registration: the `CallToolRequestSchema` handler dispatches incoming tool calls to `callTool`, which routes to the validate_code_security handler.

  server.setRequestHandler(CallToolRequestSchema, async (request) => {
    const { name, arguments: args = {} } = request.params;
    logToFile(`[MCP] CallTool: ${name} with args: ${JSON.stringify(args)}`);
    return callTool(name, args, instructions);
  });

• src/rules/matcher.ts:170-218 (helper)

  The `matchInstructions` helper function used by validateCodeSecurity to score and match security rules against the provided language/context.

  export function matchInstructions(
    context: MatchContext,
    allInstructions: Instruction[]
  ): MatchResult {
    const scoredInstructions: ScoredInstruction[] = [];
    const matchedBy: MatchResult['metadata']['matchedBy'] = {};
    
    // Score all instructions
    for (const instruction of allInstructions) {
      const scored = scoreInstruction(instruction, context);
      if (scored.score > 0) {
        scoredInstructions.push(scored);
      }
    }
    
    // Sort by priority (high to low), then by score
    scoredInstructions.sort((a, b) => {
      if (a.priority !== b.priority) {
        return b.priority - a.priority;
      }
      return b.score - a.score;
    });
    
    // Count matches by type
    matchedBy.critical = scoredInstructions.filter(s => s.priority === Priority.CRITICAL).length;
    matchedBy.language = scoredInstructions.filter(s => s.matchReasons.includes('language')).length;
    matchedBy.filepath = scoredInstructions.filter(s => s.matchReasons.includes('filepath')).length;
    matchedBy.context = scoredInstructions.filter(s => s.matchReasons.includes('context')).length;
    
    // Priority breakdown
    const priorityBreakdown = {
      critical: scoredInstructions.filter(s => s.priority === Priority.CRITICAL).length,
      high: scoredInstructions.filter(s => s.priority === Priority.HIGH).length,
      medium: scoredInstructions.filter(s => s.priority === Priority.MEDIUM).length,
      low: scoredInstructions.filter(s => s.priority === Priority.LOW).length,
    };
    
    // Limit to top 15 rules to keep response size manageable
    const topInstructions = scoredInstructions.slice(0, 15);
    
    return {
      instructions: topInstructions.map(s => s.instruction),
      metadata: {
        totalMatched: scoredInstructions.length,
        matchedBy,
        priorityBreakdown,
      },
    };
  }