Skip to content

Cybersecurity

cybersecurity — mvp.cybersecurity

Cluster: Uncategorised | Type: component | MCP Tools: 26

Overview

Static security analysis block that scans source code, Python directories, and dependency manifests for vulnerabilities, secrets, and cryptographic weaknesses. Provides eight operations (static_scan, secret_scan, dependency_scan, crypto_audit, scan_path, get_info, get_capabilities, reset) backed by a built-in knowledge base of CWE patterns, STRIDE categories, and ATT&CK TTPs, returning structured Finding objects with CVSS scores and remediation advice. Every scan output carries a reliability envelope (completion_state, warning_card, evidence, agentic_evidence) and is labelled decision_support_only — the scanner is heuristic (no measured false-positive/false-negative corpus), so clean results are review-assist evidence, not an authoritative security verdict. The read-only get_capabilities op (and the MCP describe op) reports scanner-engine availability, LLM/agentic mode, write policy, supported languages, and per-op degradation semantics for runtime environment readiness checks.

Scope and production use

This component is a lightweight defensive scanner for early feedback, reliability gates, and MCP-assisted code review. It is not a complete production security platform, penetration test, compliance certification, or substitute for expert security review. Treat clean results as useful evidence, not proof that code is secure; production launches should still use maintained SAST/secret/dependency tooling, manual review for high-risk changes, and incident-response processes appropriate to the deployment.

Empty is not clean; scans never reach verified

A scan op is at best qualified-draft — it never returns verified, because the scanner is heuristic decision support, not measured security authority. When a real backend cannot run (bandit missing, subprocess timeout, OSV unreachable, LLM offline) the scan fails closed: it does not present empty findings as a clean pass. The result carries a tool_unavailable / scan_did_not_execute marker plus the G6_E_CYBERSEC_SCANNER_UNAVAILABLE code, and evidence.scan_executed distinguishes "a scanner ran and found nothing" (executed; the trace lists the backend) from "the scanner did not run" (degraded). An unexpected live-scan exception raises rather than silently substituting canned data. If a caller marks a scanner as required (required_scanners) and it is unavailable, the op escalates to blocked-escalated. Canned KNOWN_VULNS_DEMO data and offline adapters sit behind an explicit allow_offline_canned flag (off by default) and are always marked degraded/reduced-fidelity — never reported as a real executed scan. get_capabilities may report verified, but only as a capability-discovery signal (kind: capability_discovery, security_verdict: false), not as a clean-scan verdict. There is no measured false-positive/false-negative gold corpus, so only real executed scans constitute evidence and findings remain review-assist material.

When to use:

  • Running automated security gate checks before deploying a new component or service
  • Detecting hardcoded secrets, weak cipher usage, or known-vulnerable dependency versions in CI
  • Generating a structured risk report with CWE/STRIDE/ATT&CK mappings for audit or compliance purposes

Example:

from mvp.cybersecurity import CybersecurityBlock, CybersecurityInput

block = CybersecurityBlock(name="cybersec")
result = block.infer(CybersecurityInput(
    op="static_scan",
    source='password = "hunter2"\neval(user_input)',
))
# result.ok → True; result.value → CybersecurityOutput with findings, risk_score, summary

Works well with: formal_methods, self_debug, system_doctor

Public API

CybersecurityBlock(AIBlock[CybersecurityInput, CybersecurityOutput, dict])

Field Type Default
name str 'cybersecurity'
state dict field(default_factory=dict)

Methods:

infer(data: CybersecurityInput) -> Result[CybersecurityOutput]

set_review_planner(planner) -> None

Test/integration seam to inject a security review planner.

Finding(BaseModel)

A single security finding.

Field Type Default
cwe_id str ''
cwe_name str ''
severity str 'medium'
cvss_score float 0.0
file_path str ''
line int 0
code_snippet str ''
description str ''
recommendation str ''
stride_category str ''
attck_ttp str ''
source str ''

CybersecurityInput(BaseModel)

Input to CybersecurityBlock.

Field Type Default
op CybersecurityOp required
source str ''
file_path str ''
packages list[dict[str, str]] Field(default_factory=list)
scan_dir str ''
required_scanners list[str] Field(default_factory=list)

CybersecurityOutput(BaseModel)

Output from CybersecurityBlock.

Field Type Default
op str required
findings list[Finding] Field(default_factory=list)
risk_score float 0.0
summary str ''
metadata dict[str, Any] Field(default_factory=dict)
degraded bool False
degradation_reason str \| None None
completion_state Literal['verified', 'qualified-draft', 'blocked-escalated'] \| None None
warning_card dict[str, Any] \| None None
evidence dict[str, Any] Field(default_factory=dict)
agentic_evidence dict[str, Any] Field(default_factory=dict)
decision_support_only bool False
request_id str \| None None
task_id str \| None None
run_id str \| None None

Functions

list_patterns() -> dict[str, Any]

Return the cybersecurity applied-pattern + skill surface.

MCP Tools

Operation Source
static_scan cybersecurity_mcp
secret_scan cybersecurity_mcp
dependency_scan cybersecurity_mcp
crypto_audit cybersecurity_mcp
scan_path cybersecurity_mcp
threat_model cybersecurity_mcp
classify_vuln cybersecurity_mcp
attack_tree cybersecurity_mcp
stride_map cybersecurity_mcp
attck_map cybersecurity_mcp
draft_patch cybersecurity_mcp
validate_patch cybersecurity_mcp
sandbox_test cybersecurity_mcp
apply_patch cybersecurity_mcp
rollback cybersecurity_mcp
health_check cybersecurity_mcp
drift_detect cybersecurity_mcp
breach_sim cybersecurity_mcp
regression_test cybersecurity_mcp
compliance_check cybersecurity_mcp
summary cybersecurity_mcp
vuln_detail cybersecurity_mcp
risk_score cybersecurity_mcp
timeline cybersecurity_mcp
export_sarif cybersecurity_mcp
describe cybersecurity_mcp