User Input → Validation Layer → Sanitization → Execution → Output
              (Zod schemas)    (Path/SQL/cmd)  (Gated)     (Truncated)
                    │                │             │           │
                    ▼                ▼             ▼           ▼
            Type & Format    Path Traversal   Category    Content Size
            Validation       Prevention       Enforcement Limits

function validatePath(userPath: string, basePath: string): boolean {
  // Empty check
  if (!userPath) return false;
  
  // UNC path prevention
  if (userPath.startsWith('\\\\')) return false;
  
  // Resolve against base path and verify within allowed boundaries
  const resolved = resolvePath(userPath);
  return isWithinAllowedBase(resolved, basePath);
}

function sanitizeCommand(command: string): { safe: boolean; reason?: string } {
  // Layer 1: Dangerous pattern blocking
  if (command.includes('rm -rf') || command.includes('sudo')) return { safe: false, reason: 'Dangerous command' };
  
  // Layer 2: Category enforcement
  const categories = classifyCommand(command);
  if (!isCategoryEnabled(categories)) return { safe: false, reason: 'Category disabled' };
  
  return { safe: true };
}

// Example from fileSystemTools.ts
parameters: {
  file_name: z.string().describe('The name of the file to read'),
  max_length: z.number().int().min(1).max(50000).optional().default(5000),
}

// Example from executionTools.ts
parameters: {
  javascript: z.string(), // Dangerous pattern detection applied in implementation
  timeout_seconds: z.number().min(0.1).max(60).optional().default(5),
}

// In security.ts
export function validatePath(userPath: string, basePath: string): boolean {
  if (!userPath || userPath.startsWith('\\\\')) return false;
  
  const resolved = resolvePath(userPath);
  return isWithinAllowedBase(resolved, basePath);
}

// Helper to check if path is within allowed boundaries
function isWithinAllowedBase(path: string, base: string): boolean {
  const normalizedPath = path.replace(/\\/g, '/').toLowerCase();
  const normalizedBase = base.replace(/\\/g, '/').toLowerCase();
  return normalizedPath.startsWith(normalizedBase + '/') || normalizedPath === normalizedBase;
}

// In security.ts
export function sanitizeCommand(command: string): { safe: boolean; reason?: string } {
  // Layer 1: Dangerous pattern blocking
  const dangerousPatterns = [
    /rm\s+-rf/i,           // Mass deletion
    /sudo\s+/i,            // Privilege escalation
    /;\s*exit\b/i,         // Session termination
    /\$\(/i,               // Command substitution
    /`[^`]+`/i,            // Backtick command execution
  ];
  
  for (const pattern of dangerousPatterns) {
    if (pattern.test(command)) return { safe: false, reason: 'Dangerous command detected' };
  }
  
  // Layer 2: Pipe and semicolon limits
  const pipeCount = (command.match(/\|/g) || []).length;
  if (pipeCount > 2) return { safe: false, reason: 'Too many pipes' };
  
  const semiCount = (command.match(/;/g) || []).length;
  if (semiCount > 1) return { safe: false, reason: 'Too many semicolons' };
  
  // Layer 3: Category enforcement (checked in toolsProvider.ts)
  return { safe: true };
}

const dangerousPatterns = [
  /\beval\s*\(/i,               // Code injection
  /\bexec\s*\(/i,              // Code execution  
  /Function\s*\(/i,            // Function constructor (eval alternative)
  /String\.fromCharCode\s*\(/i, // fromCharCode bypass
  /__proto__/i,                // Prototype pollution
  /require\.resolve/i,         // Module resolution abuse
  /\bchild_process\b/i,        // Process spawning
  /os\.system/i,               // OS command execution
];

for (const pattern of dangerousPatterns) {
  if (pattern.test(code)) return { success: false, error: `Dangerous code detected` };
}

const dangerousPatterns = [
  /\bimport\s+os\b/i,
  /import\s+subprocess\b/i,
  /__import__\s*\(/i,
  /\beval\s*\(/i,
  /\bexec\s*\(/i,
];

for (const pattern of dangerousPatterns) {
  if (pattern.test(code)) return { success: false, error: `Dangerous Python import detected` };
}

export function validateSQLQuery(query: string): { valid: boolean; reason?: string } {
  const dangerousPatterns = [
    /\bDROP\s+/i,           // Destructive operations
    /\bDELETE\s+FROM/i,     // Data deletion
    /\bUPDATE\s+\w+\s+SET\b/i, // Data modification without WHERE
    /;\s*SELECT\b/i,        // Stacked queries
  ];
  
  for (const pattern of dangerousPatterns) {
    if (pattern.test(query)) return { valid: false, reason: 'Unsafe SQL query detected' };
  }
  
  return { valid: true };
}

function validateUrl(url: string): { valid: boolean; error?: string } {
  const parsed = new URL(url);
  
  // Block non-HTTP protocols
  if (!['http:', 'https:'].includes(parsed.protocol)) {
    return { valid: false, error: `Protocol "${parsed.protocol}" is not allowed` };
  }
  
  // Block private IP ranges (basic check)
  const hostname = parsed.hostname;
  const blockedPatterns = [
    /^127\./,           // localhost
    /^10\./,            // 10.0.0.0/8
    /^172\.1[6-9]\./,   // 172.16.0.0/12
    /^172\.2[0-9]\./,   // 172.16.0.0/12  
    /^172\.3[0-1]\./,   // 172.16.0.0/12
    /^192\.168\./,      // 192.168.0.0/16
    /^localhost$/,      // localhost hostname
  ];
  
  if (blockedPatterns.some(pattern => pattern.test(hostname))) {
    return { valid: false, error: `Access to ${hostname} is blocked for security reasons` };
  }
  
  return { valid: true };
}

# Check for outdated packages with security issues
npm audit

# Update vulnerable dependencies
npm update

{
  "overrides": {
    "glob": "^13.0.6",
    "uuid": "^11.0.4"
  }
}