Skip to content

threat-model.md

Latest commit

 

History

History
41 lines (29 loc) · 4.84 KB

threat-model.md

File metadata and controls

41 lines (29 loc) · 4.84 KB
Raw

Threat Model

Nightward inspects local AI agent and devtool state, so its primary risk is accidental disclosure or mutation of private local data.

Assets

  • MCP server configs and executable arguments.
  • Agent/editor settings, skills, rules, and local workflow files.
  • Credentials, auth files, tokens, headers, env files, and private local paths.
  • Redacted reports, SARIF files, fix-plan exports, and planned scheduled scan reports.
  • Release artifacts, GitHub Actions workflows, and package metadata.

Trust Boundaries

  • Local filesystem input is untrusted. Config files may be malformed, hostile, huge, symlinked, or privacy-sensitive.
  • CLI/TUI/Raycast output is a disclosure boundary. Secret values must not cross it.
  • Optional providers are execution boundaries. They are discovered, selected, and installed only through explicit action paths, unselected providers are skipped, online-capable providers are blocked until explicitly allowed, and provider timeout/output-cap failures are surfaced as warnings instead of clean results. Trivy, Grype, OSV-Scanner, OpenSSF Scorecard, and Socket are treated as online-capable when their normal operation can contact external services.
  • MCP clients are agent boundaries. nw mcp serve exposes local context, bounded action previews, approval requests, and approved-ticket apply through stdio, so returned tool/resource/prompt content must stay redacted and MCP clients must never be able to self-confirm writes.
  • GitHub Actions and Trunk integrations treat repository contents and PR input as untrusted.
  • Scheduler install/remove is explicit, confirmation-gated, and user-level only.
  • Release automation and npm publishing are privileged publishing boundaries.

Threats And Controls

  • Secret disclosure: redact env/header values, secret-looking args, token-like strings, and Markdown/SARIF/TUI exports; test every output surface.
  • Unexpected mutation: scan, doctor, findings, fix, policy, backup-plan, snapshot-plan, analysis, and GitHub Action policy paths stay read-only except explicit output files. TUI, Raycast, CLI, and MCP approved-ticket writes must flow through the shared action registry with disclosure acceptance and local approval/confirmation; cleanup actions are limited to Nightward-owned report, log, and cache paths.
  • Unsafe portability: classify secret-auth, app-owned, runtime-cache, machine-local, and unknown state as non-portable. Unknown state means entries Nightward cannot validate through a known schema, known portable path pattern, recognized file type, or provenance signal, including unrecognized config shapes, runtime artifacts without source metadata, and dynamically generated secret-like files. Implementations detect it through schema validation, path allowlists/denylists, file-type checks, and provenance checks. Exclude those entries from portability and snapshot exports by default; Nightward v1 has no auto-include override, and any future override must require explicit user confirmation plus an audit event.
  • MCP execution ambiguity: flag shell wrappers, broad filesystem access, unpinned package execution, package-name impersonation risk, remote package sources, Docker/socket exposure, local/private endpoints, sensitive headers/env, token paths, stale configs, app-owned state, and unknown shapes.
  • Supply-chain compromise: pin GitHub Actions by full SHA, use Renovate, run Gitleaks/OSV/CodeQL/Clippy/Trunk, keep release artifacts signed, and keep the npm package as a no-postinstall launcher that verifies archive checksums, rejects unsafe archive entries, and can require Sigstore verification in strict environments.
  • Malformed config denial-of-service: keep parser/fuzz coverage for MCP JSON/TOML/YAML, URL/header redaction, symlink traversal, huge-file handling, and malformed configs.
  • Agent overreach through MCP: MCP can request bounded action approvals, but it cannot accept the responsibility disclosure, approve its own request, change approved arguments, replay tickets, or apply local writes without a local CLI/TUI/Raycast approval. Tool inputs are validated against strict server-side schemas, approval records are exact-preview digested and one-time, and explicit workspace/report paths are scoped under NIGHTWARD_HOME with no-symlink regular-file/directory checks. Do not expose live MCP/agent config mutation, restore, sync, HTTP listener behavior, or arbitrary local writes through MCP v1.

Non-Goals

Nightward does not prove a tool, package, MCP server, or URL is safe. It reports local structure, known risky signals, and review guidance.

Nightward can create local portable backup snapshots, but it does not restore, sync, push to Git, or mutate agent configs in v1.

Review Triggers

Update this model before adding live MCP/agent config mutation, restore, encrypted sync, hosted dashboards, release/npm publishing changes, direct MCP writes without local approval, or new writable integrations.