Skip to content

v1.2.0.md

Latest commit

 

History

History
280 lines (200 loc) · 7.59 KB

v1.2.0.md

File metadata and controls

280 lines (200 loc) · 7.59 KB

Release Notes - v1.2.0

Release Date: 2025-12-14 Type: Security Hardening Release

Summary

This release focuses on comprehensive security hardening for the CyberChef MCP Server Docker container. Key improvements include non-root user execution, automated vulnerability scanning with Trivy, SBOM (Software Bill of Materials) generation, and read-only filesystem support.

Security Hardening Features

Non-Root Container Execution (P0)

The container now runs as a dedicated non-root user instead of root:

  • User: cyberchef (UID 1001)
  • Group: cyberchef (GID 1001)
# Verify non-root execution
docker run --rm cyberchef-mcp id
# Output: uid=1001(cyberchef) gid=1001(cyberchef)

Security Benefits:

  • Prevents privilege escalation attacks
  • Limits damage from container escape vulnerabilities
  • Follows container security best practices

Automated Vulnerability Scanning with Trivy (P0)

Integrated Trivy for comprehensive security scanning:

Build-Time Scanning

  • Every push to master triggers vulnerability scan
  • Every pull request is scanned
  • Results uploaded to GitHub Security tab (SARIF format)
  • Non-root execution verification in CI

Release Scanning

  • Final image scanned before publication to GHCR
  • Scan results attached to release
  • SBOM generated and attached

Scheduled Scanning

  • Weekly scans (Sundays at midnight UTC)
  • Catches newly discovered CVEs
  • Manual trigger available via workflow_dispatch

SBOM Generation (P2)

Software Bill of Materials generated for each release:

  • Format: CycloneDX JSON
  • Coverage: OS packages and npm dependencies
  • Attachment: Automatically attached to GitHub releases
  • Use Case: Supply chain transparency, compliance, dependency tracking
# Download SBOM from release
wget https://github.com/doublegate/CyberChef-MCP/releases/download/v1.2.0/sbom.cyclonedx.json

Read-Only Filesystem Support (P1)

Container now supports running with a read-only root filesystem:

# Run with read-only filesystem
docker run -i --rm --read-only --tmpfs /tmp:size=100M cyberchef-mcp

Security Benefits:

  • Prevents runtime modifications to container filesystem
  • Immutable deployment configuration
  • Reduced attack surface

Recommended Secure Deployment

For maximum security, use all available options:

docker run -i --rm \
  --read-only \
  --tmpfs /tmp:size=100M \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  cyberchef-mcp

Docker Image Changes

Dockerfile.mcp Updates

# Security highlights from updated Dockerfile

# Non-root user creation
RUN addgroup -g 1001 -S cyberchef && \
    adduser -u 1001 -S cyberchef -G cyberchef

# Attack surface reduction
RUN rm -rf .git .github tests docs *.md ...

# Ownership and user switch
RUN chown -R cyberchef:cyberchef /app
USER cyberchef

# Health check for orchestration
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD node -e "process.exit(0)" || exit 1

OCI Image Labels

Added standard OCI labels for metadata:

  • org.opencontainers.image.title
  • org.opencontainers.image.description
  • org.opencontainers.image.vendor
  • org.opencontainers.image.licenses
  • org.opencontainers.image.source
  • org.opencontainers.image.documentation

Attack Surface Reduction

Removed from production image:

  • .git directory
  • .github directory
  • tests directory
  • docs directory
  • *.md files (README, CHANGELOG, etc.)
  • Build configuration files (Gruntfile.js, babel.config.js, etc.)

CI/CD Enhancements

New Workflow: security-scan.yml

name: Security Scan
on:
  push: [master]
  pull_request: [master]
  schedule: [{cron: '0 0 * * 0'}]  # Weekly
  workflow_dispatch:

jobs:
  trivy-scan:        # Container vulnerability scan
  dependency-scan:   # npm audit + Trivy filesystem
  sbom-generation:   # CycloneDX SBOM

Updated: mcp-docker-build.yml

  • Added Trivy vulnerability scanning
  • Added non-root execution verification
  • Results uploaded to GitHub Security tab

Updated: mcp-release.yml

  • Added SBOM generation with Trivy
  • Added vulnerability scan on release image
  • SBOM attached to GitHub release

Documentation Updates

New: SECURITY.md

Comprehensive security policy including:

  • Supported versions table
  • Vulnerability reporting procedures
  • Security measures documentation
  • Secure deployment guidelines
  • Docker Hardened Images (DHI) information

Updated: README.md

  • Added security scan badge
  • Updated security section with v1.2.0 features
  • Added Security Scan workflow to CI/CD section
  • Updated version references

Updated: docs/user_guide.md

  • New "Security Best Practices" section
  • Non-root execution verification
  • Read-only filesystem instructions
  • Recommended security options
  • Vulnerability scanning information

Docker Hardened Images (DHI)

Docker Hardened Images for Node.js 22 are available via Docker Hub subscription. While this open-source project uses node:22-alpine with manual hardening for compatibility, enterprise deployments may consider DHI for additional security benefits:

  • Up to 95% vulnerability reduction
  • FIPS-ready variants
  • Automated CVE patching

See Docker DHI Documentation for more information.

Migration Guide

For Users

  1. Pull the latest image:

    docker pull ghcr.io/doublegate/cyberchef-mcp_v1:latest

  2. Verify non-root execution:

    docker run --rm cyberchef-mcp id
# Expected: uid=1001(cyberchef) gid=1001(cyberchef)

  3. Update client configurations if using specific version tags:

    • Replace v1.1.0 with v1.2.0 in config files

  4. No protocol changes: MCP interface unchanged

For Developers

  1. Update local builds:

    git pull origin master
docker build -f Dockerfile.mcp -t cyberchef-mcp .

  2. Test non-root execution:

    docker run --rm cyberchef-mcp id

  3. Review security scan results in GitHub Security tab

Breaking Changes

None. This release maintains full backward compatibility with v1.1.0.

Known Issues

Remaining Development Dependencies

Some development dependencies have known vulnerabilities that do not affect the production MCP server runtime:

  • babel-traverse@6.26.0 - Development build only
  • shelljs@0.8.1 - Build artifact permissions only

Production MCP server runtime risk: Low

Files Changed

New Files

  • .github/workflows/security-scan.yml

Modified Files

  • Dockerfile.mcp - Complete security hardening
  • .github/workflows/mcp-docker-build.yml - Added Trivy + non-root verification
  • .github/workflows/mcp-release.yml - Added SBOM generation
  • SECURITY.md - Comprehensive security policy
  • README.md - Security badge and documentation
  • docs/user_guide.md - Security best practices
  • src/node/mcp-server.mjs - Version bump to 1.2.0
  • package.json - mcpVersion bump to 1.2.0
  • CHANGELOG.md - v1.2.0 release notes

Contributors

  • DoubleGate (@doublegate)
  • Claude Opus 4.5 (AI pair programming assistant)

Links

Full Changelog: v1.1.0...v1.2.0