<div align="center">

<p align="center">
  <strong>🇺🇸 English</strong> · <a href="./docs/locales/ko.md">🇰🇷 한국어</a> · <a href="./docs/locales/zh-CN.md">🇨🇳 中文</a> · <a href="./docs/locales/es.md">🇪🇸 Español</a> · <a href="./docs/locales/hi.md">🇮🇳 हिन्दी</a><br />
  <a href="./docs/locales/ar.md">🇸🇦 العربية</a> · <a href="./docs/locales/pt-BR.md">🇧🇷 Português</a> · <a href="./docs/locales/ru.md">🇷🇺 Русский</a> · <a href="./docs/locales/fr.md">🇫🇷 Français</a> · <a href="./docs/locales/id.md">🇮🇩 Bahasa Indonesia</a>
</p>

<p align="center">
  <img src="./docs/assets/locales/en/banner.svg" alt="VulnForge MCP banner" width="100%" />
</p>

# 🛡️ VulnForge MCP

**Universal AI-Native Web, API &amp; Database Vulnerability Auditing with Automated Patch Injection MCP Server**

[![License: Proprietary](https://img.shields.io/badge/License-Proprietary-red.svg)](./LICENSE)
[![Protocol: MCP](https://img.shields.io/badge/Protocol-Model_Context_Protocol-6366f1.svg)](https://modelcontextprotocol.io/)
[![Language: TypeScript](https://img.shields.io/badge/Language-TypeScript_ESM-3178c6.svg)](https://www.typescriptlang.org/)
[![Security: OWASP Top 10](https://img.shields.io/badge/Security-OWASP_Top_10_Audit-10b981.svg)](#-the-4-vulnerability-auditing-pillars)
[![Crypto: age X25519](https://img.shields.io/badge/Crypto-age_X25519-8b5cf6.svg)](#-enterprise-security--age-cryptographic-protection)

<sub>Architected &amp; Licensed under Proprietary (All Rights Reserved) · Autonomous Security Engineering</sub>

</div>

---

## ⚡ Quickstart & 1-Line Execution

<details open>
<summary><b>⚡ Quickstart & 1-Line Execution (Click to toggle / 접기·펼치기)</b></summary>
<br>

Run VulnForge MCP directly with zero prior installation:

```bash
# 1. Start MCP Server over stdio
npx vulnforge-mcp

# 2. Run Built-in Security Audit Demonstration
npx vulnforge-mcp --test-demo
```

### Adding to Claude Desktop / Antigravity (`claude_desktop_config.json`)
```json
{
  "mcpServers": {
    "vulnforge": {
      "command": "node",
      "args": ["C:/github_nvcxzopgo/vulnforge-mcp/dist/index.js"]
    }
  }
}
```

</details>

---

## 🏛️ The 4 Vulnerability Auditing Pillars

<details open>
<summary><b>🏛️ View Architecture Pipeline Diagram (Click to toggle / 접기·펼치기)</b></summary>
<br>

<p align="center">
  <img src="./docs/assets/locales/en/architecture.svg" alt="VulnForge MCP Architecture Pipeline" width="100%" />
</p>

| # | Pillar Domain | Scope &amp; Target Checks | Automated Patch Output |
|---|---|---|---|
| **01** | **Web &amp; Headers** | Content-Security-Policy, HSTS, CORS Wildcards, X-Frame-Options, Cookie Flags | Express/Fastify/Koa security header injection middleware |
| **02** | **Frontend &amp; DOM** | DOM XSS sinks (`innerHTML`, `document.write`, `eval`), Tabnabbing (`target="_blank"`), SRI hashes | Safe `textContent` rewriter &amp; `rel="noopener noreferrer"` attributes |
| **03** | **API &amp; Endpoints** | Broken Object Level Auth (BOLA/IDOR), Unauthenticated mutation routes, Mass assignment | Tenant ownership validators, auth middlewares, Zod DTO parsers |
| **04** | **Database &amp; SQLi** | Raw template string queries, SQL concatenation, MongoDB `$where`, Credential leaks | Parameterized statements (`$1, $2`), NoSQL sanitizers, env configs |

</details>

---

## 🛠️ 5 Core MCP Security Tools

<details open>
<summary><b>🛠️ 5 Core MCP Security Tools (Click to toggle / 접기·펼치기)</b></summary>
<br>

VulnForge MCP exposes 5 specialized security audit tools to your AI agent:

1. **`vulnforge_audit_web`**:
   - Analyzes HTTP response headers, cookie flags, and DOM client code.
   - Computes an automated Security Score (0 to 100) and outputs prioritized CWE findings.
2. **`vulnforge_audit_api`**:
   - Inspects route definitions (Express, Fastify, Next.js) or OpenAPI specifications.
   - Flags BOLA/IDOR patterns, missing auth middleware, and mass assignment risks.
3. **`vulnforge_audit_db`**:
   - Evaluates SQL queries and ORM calls (Sequelize, Prisma, TypeORM, Knex, Mongoose).
   - Identifies raw string concatenation, unescaped interpolations, and NoSQL injection vectors.
4. **`vulnforge_inject_patch`**:
   - Takes vulnerable code and automatically synthesizes a secure drop-in replacement.
   - Returns both patched code and a unified git diff for transparent review.
5. **`vulnforge_full_scan`**:
   - Executes an end-to-end 360-degree security audit across Web, API, and DB layers simultaneously.

</details>

---

## ⚡ Automated Defensive Patch Injection Engine

<details open>
<summary><b>⚡ Automated Defensive Patch Injection Engine (Click to toggle / 접기·펼치기)</b></summary>
<br>

VulnForge not only detects flaws, but actively writes defensive patches:

```diff
--- a/database.ts
+++ b/database.ts
@@ -1,3 +1,3 @@
- const user = await db.query(`SELECT * FROM users WHERE email = ${email}`);
+ const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);
```

```diff
--- a/frontend.js
+++ b/frontend.js
@@ -1,2 +1,2 @@
- document.getElementById('name').innerHTML = userName;
+ document.getElementById('name').textContent = userName;
```

</details>

---

## 🔐 Enterprise Security & age Cryptographic Protection

<details open>
<summary><b>🔐 Enterprise Security & age Cryptographic Protection (Click to toggle / 접기·펼치기)</b></summary>
<br>

All proprietary signatures and sensitive core modules are protected via modern UNIX-philosophy cryptographic tools:
- **age (X25519)**: Fast, modern file encryption replacing legacy PGP.
- **Minisign (Ed25519)**: Detached signature verification for high-assurance release binaries.
- **Post-Quantum Cryptography (ML-KEM-768 / Kyber)**: Quantum-resistant hybrid key encapsulation for long-term audit trail confidentiality.
- **3-Tier Key Backup**: NTFS permission isolation + Windows DPAPI hardware binding + Encrypted Cloud Mirror.

</details>

---

## 🌐 Tri-Platform Mirroring Architecture (GitHub · GitLab · Hugging Face)

<details open>
<summary><b>🌐 Tri-Platform Mirroring Architecture (GitHub · GitLab · Hugging Face) (Click to toggle / 접기·펼치기)</b></summary>
<br>

Every commit pushed to the primary GitHub repository is automatically synchronized in real-time across 3 major platforms via GitHub Actions (`.github/workflows/mirror.yml`):
- **GitHub**: [https://github.com/mason-keller/vulnforge-mcp](https://github.com/mason-keller/vulnforge-mcp)
- **GitLab**: [https://gitlab.com/keller-lab/vulnforge-mcp](https://gitlab.com/keller-lab/vulnforge-mcp)
- **Hugging Face**: [https://huggingface.co/mason-keller/vulnforge-mcp](https://huggingface.co/mason-keller/vulnforge-mcp)

</details>

---

## 📄 Proprietary Software License

<details open>
<summary><b>📄 Proprietary Software License (Click to toggle / 접기·펼치기)</b></summary>
<br>

```text
PROPRIETARY &amp; CONFIDENTIAL SOFTWARE LICENSE
Copyright (c) 2026 The Authors &amp; Workspace Owner. All Rights Reserved.

Publicly visible on GitHub for evaluation, reference, and educational review only.
Unauthorized copying, modification, redistribution, or commercial use is strictly prohibited.
```

</details>