ISO 27001SAFE

revoke_api_key

.nojekyll

.nojekyll

const pkg = require("../../package.json") as { version?: string };

import { MIGRATIONS } from "../../src/db/migrations/index.js";

import { seedAll } from "../../src/seed/seeder.js";

import { McpError } from "../../src/types/errors.js";

vi.mock("../../src/db/connection.js", () => ({

| `CORS_ORIGIN` | `http://192.168.1.50:3000` | The exact origin your Claude Desktop connects from |

proxy_pass         http://127.0.0.1:3001;

@vitest/coverage-istanbul, @vitest/coverage-v8, ajv, ajv-formats, vitest, express

**Server egress:** `iso27001-mcp` itself does not transmit ISMS records to the package author, analytics services, or any AI provider. In local stdio mode the server opens no network listener and make

incident_handling: ['Detection & Identification — monitor SIEM alerts; staff report via [email protected]', 'Initial Assessment — classify severity (P1/P2/P3) within 15 min; P1 triggers war-room', 'Con

> **Server egress:** `iso27001-mcp` itself does not transmit ISMS records to the package author, analytics services, or any AI provider. In local stdio mode the server opens no network listener and ma

- Must report any suspected compromise of their credentials immediately to the security team ([email protected])

> Your Node.js was installed system-wide and `npm install -g` needs write access to a root-owned directory. **Do not use `sudo npm install -g`** — it causes other issues. Instead, install Node via [nv

> **Permission error on Linux/macOS?** Do not use `sudo npm install -g`. Instead, install Node.js via [nvm](https://github.com/nvm-sh/nvm) or [Volta](https://volta.sh) — both install Node into your ho

**Finding:** AWS IAM access advisor review identified 4 developer accounts with persistent `AdministratorAccess` policy attached, providing unrestricted access to all AWS services in the production en

- AWS Config conformance pack deployed with rules covering: S3 public access block, IAM password policy, CloudTrail multi-region enabled, Security Groups unrestricted access, KMS key rotation enabled,

- Read-only guest access (no API key required for public resource URIs in hosted mode)

- **Malicious local user** — a user on the same machine who can read environment variables, file system paths, or process memory

- **stdio transport:** The OS process boundary is the trust boundary. No network interfaces are involved. A process-level attacker (running as the same user) can read environment variables. Operators

- Are responsible for not sharing their access credentials with any other person

6. **Post-departure monitoring:** AWS CloudTrail and system logs are monitored for 30 days post-departure for any access attempts using former credentials

**Pinned toolchain:** Node.js version is pinned via `volta.node` in `package.json` (currently `20.11.0`). Install Volta to get the exact same Node version: `curl https://get.volta.sh | bash`.