security_check

Instructions

Implementation Reference

• src/guidelines-manager.ts:40-53 (registration)

  Tool registration: defines the 'security_check' tool with name, description, and input schema (requires 'code' string).

  {
    name: 'security_check',
    description: 'Perform security analysis on code using configured security rules',
    inputSchema: {
      type: 'object',
      properties: {
        code: {
          type: 'string',
          description: 'The code to check for security issues',
        },
      },
      required: ['code'],
    },
  },

• src/guidelines-manager.ts:87-88 (handler)

  Tool dispatch: routes 'security_check' calls to performSecurityCheck(args.code).

  case 'security_check':
    return await this.performSecurityCheck(args.code);

• src/guidelines-manager.ts:171-204 (handler)

  Handler logic: performSecurityCheck() delegates to guidelineSource.performSecurityCheck(), then formats vulnerabilities, warnings, and recommendations into a human-readable text response.

  private async performSecurityCheck(code: string) {
    try {
      const result = await this.guidelineSource.performSecurityCheck(code);
      
      const response = [];
      
      if (result.vulnerabilities.length > 0) {
        response.push(`🚨 **Vulnerabilities Found:**\n${result.vulnerabilities.map(vuln => `- ${vuln}`).join('\n')}`);
      }
      
      if (result.warnings.length > 0) {
        response.push(`⚠️ **Warnings:**\n${result.warnings.map(warning => `- ${warning}`).join('\n')}`);
      }
      
      if (result.recommendations.length > 0) {
        response.push(`💡 **Recommendations:**\n${result.recommendations.map(rec => `- ${rec}`).join('\n')}`);
      }
      
      if (response.length === 0) {
        response.push('✅ Security check passed. No obvious vulnerabilities detected.');
      }
      
      return {
        content: [
          {
            type: 'text',
            text: response.join('\n\n'),
          },
        ],
      };
    } catch (error) {
      throw new Error(`Security check failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
    }
  }

• src/guidelines-source-factory.ts:9-9 (schema)

  Interface definition: declares the return type of performSecurityCheck as { vulnerabilities: string[]; warnings: string[]; recommendations: string[] }.

  performSecurityCheck(code: string): Promise<{ vulnerabilities: string[]; warnings: string[]; recommendations: string[] }>;

• src/guidelines-source-factory.ts:57-60 (helper)

  Helper: UrlGuidelineSource.performSecurityCheck() fetches 'security-rules' guidelines and calls parseSecurityRules() to apply pattern-based rules against the code.

  async performSecurityCheck(code: string): Promise<{ vulnerabilities: string[]; warnings: string[]; recommendations: string[] }> {
    const securityGuidelines = await this.fetchGuidelines('security-rules');
    return this.parseSecurityRules(securityGuidelines, code);
  }