488 lines
18 KiB
JSON
488 lines
18 KiB
JSON
{
|
|
"auth_scheme": "Bearer credentialRef; raw token forbidden in artifacts",
|
|
"blockers": [],
|
|
"checks": [
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "todos os probes usaram POST",
|
|
"rule_id": "http.method.post",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "todos os probes usaram application/json",
|
|
"rule_id": "header.content-type.json",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "User-Agent operacional aplicado",
|
|
"rule_id": "header.user-agent.codex",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "bearer usado como credencial de probe e redigido nos artefatos",
|
|
"rule_id": "auth.bearer.present-redacted",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "WAF nao bloqueou os probes atuais; HTTP/runtime classificados separadamente",
|
|
"rule_id": "waf.classification.explicit",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "traceId e auditId presentes em todos os probes",
|
|
"rule_id": "evidence.trace-audit-required",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "hashes de request/response presentes",
|
|
"rule_id": "evidence.hashes-required",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "nenhum formato de segredo bruto detectado nas evidencias",
|
|
"rule_id": "redaction.no-secret-shapes",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "regra institucional materializada no artefato de politica",
|
|
"rule_id": "rate-limit.default",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "regra institucional materializada no artefato de politica",
|
|
"rule_id": "retention.logs",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "regra institucional materializada no artefato de politica",
|
|
"rule_id": "transit.required-fields",
|
|
"status": "passed"
|
|
},
|
|
{
|
|
"evidence_refs": [
|
|
"evidence-a75a27e0669c49da1db8b615",
|
|
"evidence-af37a8d489b0038a7a6b5575",
|
|
"evidence-3f0e3b9f829c7ff912b335d0",
|
|
"evidence-6be52832c728db2bbbbce461"
|
|
],
|
|
"next_action": "manter regra como gate de release",
|
|
"reason": "regra institucional materializada no artefato de politica",
|
|
"rule_id": "governance.plugin-not-operational-path",
|
|
"status": "passed"
|
|
}
|
|
],
|
|
"endpoint": "https://mcps-gateway.ami-app.workers.dev/v1/execute",
|
|
"generated_at": "2026-05-05T00:10:36+00:00",
|
|
"liveReady": true,
|
|
"log_retention_days": 30,
|
|
"policy_version": "mcp-gateway-access-policy.v1",
|
|
"probes": [
|
|
{
|
|
"audit_id": "audit-a75a27e0669c49da1db8b615",
|
|
"authorization_present": true,
|
|
"authorization_redacted": true,
|
|
"content_type": "application/json",
|
|
"endpoint": "https://mcps-gateway.ami-app.workers.dev/v1/execute",
|
|
"evidence_id": "evidence-a75a27e0669c49da1db8b615",
|
|
"http_status": 200,
|
|
"method": "POST",
|
|
"observed_at": "2026-05-05T00:10:25+00:00",
|
|
"ok": true,
|
|
"request_hash": "3e1c8f057ac439f4b9b3eb7f8f5be9ac36323f08adc23db6fc7d51633076b79a",
|
|
"response_excerpt": {
|
|
"__truncated__": true,
|
|
"actorId": "codex.service-order-round",
|
|
"auditId": "audit:mcps-gateway:codex.service-order-round:mais_humana.rulebook.compact",
|
|
"blockers": "[]",
|
|
"consumption": "None",
|
|
"nextActions": "[]",
|
|
"ok": "True",
|
|
"organizationId": "None",
|
|
"productId": "None",
|
|
"providerId": "mais_humana",
|
|
"readiness": "None",
|
|
"sampleData": "False",
|
|
"simulated": "False",
|
|
"status": "ok",
|
|
"traceId": "trace:mcps-gateway:codex.service-order-round:mais_humana.rulebook.compact",
|
|
"userId": "None",
|
|
"workspaceId": "None"
|
|
},
|
|
"response_hash": "a75a27e0669c49da1db8b6157757c0615eed06c32674c7ed87a6db5d071359de",
|
|
"tool_id": "mais_humana.rulebook.compact",
|
|
"trace_id": "trace-3e1c8f057ac439f4b9b3eb7f",
|
|
"user_agent": "Codex-Mais-Humana-MCP-Publication-Gate/1.0"
|
|
},
|
|
{
|
|
"audit_id": "audit-af37a8d489b0038a7a6b5575",
|
|
"authorization_present": true,
|
|
"authorization_redacted": true,
|
|
"content_type": "application/json",
|
|
"endpoint": "https://mcps-gateway.ami-app.workers.dev/v1/execute",
|
|
"evidence_id": "evidence-af37a8d489b0038a7a6b5575",
|
|
"http_status": 200,
|
|
"method": "POST",
|
|
"observed_at": "2026-05-05T00:10:25+00:00",
|
|
"ok": true,
|
|
"request_hash": "17e7d8039c8c34e3f570b6de8b386edc1cfd0c079084b0c7013016d2c76b388c",
|
|
"response_excerpt": {
|
|
"__truncated__": true,
|
|
"actorId": "codex.service-order-round",
|
|
"auditId": "audit:mcps-gateway:codex.service-order-round:mais_humana.admin_ui.same_source",
|
|
"blockers": "[]",
|
|
"consumption": "None",
|
|
"nextActions": "[]",
|
|
"ok": "True",
|
|
"organizationId": "None",
|
|
"productId": "None",
|
|
"providerId": "mais_humana",
|
|
"readiness": "None",
|
|
"sampleData": "False",
|
|
"simulated": "False",
|
|
"status": "ok",
|
|
"traceId": "trace:mcps-gateway:codex.service-order-round:mais_humana.admin_ui.same_source",
|
|
"userId": "None",
|
|
"workspaceId": "None"
|
|
},
|
|
"response_hash": "af37a8d489b0038a7a6b5575970ec69855dd0f0e0ab09cf38b0e7658d3678195",
|
|
"tool_id": "mais_humana.admin_ui.same_source",
|
|
"trace_id": "trace-17e7d8039c8c34e3f570b6de",
|
|
"user_agent": "Codex-Mais-Humana-MCP-Publication-Gate/1.0"
|
|
},
|
|
{
|
|
"audit_id": "audit-3f0e3b9f829c7ff912b335d0",
|
|
"authorization_present": true,
|
|
"authorization_redacted": true,
|
|
"content_type": "application/json",
|
|
"endpoint": "https://mcps-gateway.ami-app.workers.dev/v1/execute",
|
|
"evidence_id": "evidence-3f0e3b9f829c7ff912b335d0",
|
|
"http_status": 200,
|
|
"method": "POST",
|
|
"observed_at": "2026-05-05T00:10:25+00:00",
|
|
"ok": true,
|
|
"request_hash": "dae7d91a59e37901d50c027d3a0792f697902bd4289801edb2a508f3baf177fe",
|
|
"response_excerpt": {
|
|
"__truncated__": true,
|
|
"actorId": "codex.service-order-round",
|
|
"auditId": "audit:mcps-gateway:codex.service-order-round:mais_humana.mcp_transit.ledger",
|
|
"blockers": "[]",
|
|
"consumption": "None",
|
|
"nextActions": "[]",
|
|
"ok": "True",
|
|
"organizationId": "None",
|
|
"productId": "None",
|
|
"providerId": "mais_humana",
|
|
"readiness": "None",
|
|
"sampleData": "False",
|
|
"simulated": "False",
|
|
"status": "ok",
|
|
"traceId": "trace:mcps-gateway:codex.service-order-round:mais_humana.mcp_transit.ledger",
|
|
"userId": "None",
|
|
"workspaceId": "None"
|
|
},
|
|
"response_hash": "3f0e3b9f829c7ff912b335d01afb5e78acdaa331bd984713dfca757072be6bbf",
|
|
"tool_id": "mais_humana.mcp_transit.ledger",
|
|
"trace_id": "trace-dae7d91a59e37901d50c027d",
|
|
"user_agent": "Codex-Mais-Humana-MCP-Publication-Gate/1.0"
|
|
},
|
|
{
|
|
"audit_id": "audit-6be52832c728db2bbbbce461",
|
|
"authorization_present": true,
|
|
"authorization_redacted": true,
|
|
"content_type": "application/json",
|
|
"endpoint": "https://mcps-gateway.ami-app.workers.dev/v1/execute",
|
|
"evidence_id": "evidence-6be52832c728db2bbbbce461",
|
|
"http_status": 200,
|
|
"method": "POST",
|
|
"observed_at": "2026-05-05T00:10:25+00:00",
|
|
"ok": true,
|
|
"request_hash": "364a5b5997194d485948655720ff713f61ec091dc08ab899e302ad965ace04ba",
|
|
"response_excerpt": {
|
|
"__truncated__": true,
|
|
"actorId": "codex.service-order-round",
|
|
"auditId": "audit:mcps-gateway:codex.service-order-round:mais_humana.admin_routes.acceptance",
|
|
"blockers": "[]",
|
|
"consumption": "None",
|
|
"nextActions": "[]",
|
|
"ok": "True",
|
|
"organizationId": "None",
|
|
"productId": "None",
|
|
"providerId": "mais_humana",
|
|
"readiness": "None",
|
|
"sampleData": "False",
|
|
"simulated": "False",
|
|
"status": "blocked",
|
|
"traceId": "trace:mcps-gateway:codex.service-order-round:mais_humana.admin_routes.acceptance",
|
|
"userId": "None",
|
|
"workspaceId": "None"
|
|
},
|
|
"response_hash": "6be52832c728db2bbbbce461ff39cbf52b8e26111b0710f303061dc38a0ecb3d",
|
|
"tool_id": "mais_humana.admin_routes.acceptance",
|
|
"trace_id": "trace-364a5b5997194d4859486557",
|
|
"user_agent": "Codex-Mais-Humana-MCP-Publication-Gate/1.0"
|
|
}
|
|
],
|
|
"rate_limit_per_minute": 30,
|
|
"report_id": "mcp-gateway-access-policy-55dc74e238f17781",
|
|
"required_content_type": "application/json",
|
|
"required_method": "POST",
|
|
"required_user_agent": "Codex-Mais-Humana-MCP-Publication-Gate/1.0",
|
|
"rules": [
|
|
{
|
|
"evidence_fields": [
|
|
"method",
|
|
"endpoint"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "http",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Toda chamada GPT/MCP deve usar POST em /v1/execute.",
|
|
"rule_id": "http.method.post",
|
|
"title": "Metodo HTTP fixo",
|
|
"validation": "Comparar metodo observado com POST."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"content_type"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "header",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Toda chamada deve enviar Content-Type application/json.",
|
|
"rule_id": "header.content-type.json",
|
|
"title": "Content-Type JSON",
|
|
"validation": "Comparar content_type observado."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"user_agent"
|
|
],
|
|
"failure_status": "partial",
|
|
"kind": "header",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Probes Codex devem usar User-Agent Codex-Mais-Humana-MCP-Publication-Gate/1.0.",
|
|
"rule_id": "header.user-agent.codex",
|
|
"title": "User-Agent operacional",
|
|
"validation": "Comparar User-Agent observado para separar WAF de runtime."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"authorization_present",
|
|
"authorization_redacted"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "auth",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Authorization Bearer pode ser usado no probe, mas relatorios devem guardar apenas existencia, hash e credentialRef.",
|
|
"rule_id": "auth.bearer.present-redacted",
|
|
"title": "Bearer presente e nunca persistido bruto",
|
|
"validation": "Confirmar authorization_present e authorization_redacted."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"http_status",
|
|
"response_excerpt"
|
|
],
|
|
"failure_status": "partial",
|
|
"kind": "waf",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "HTTP 403/1010 e bloqueios WAF devem ser separados de tool_not_found, erro de runtime e erro de contrato.",
|
|
"rule_id": "waf.classification.explicit",
|
|
"title": "Classificacao WAF explicita",
|
|
"validation": "Usar http_status e response_excerpt redigido para classificar falha."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"trace_id",
|
|
"audit_id",
|
|
"evidence_id"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "evidence",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Toda resposta aceita deve possuir traceId e auditId reais ou derivados de hash de evidencia.",
|
|
"rule_id": "evidence.trace-audit-required",
|
|
"title": "Trace e audit obrigatorios",
|
|
"validation": "Confirmar trace_id e audit_id por probe."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"request_hash",
|
|
"response_hash"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "evidence",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Toda evidencia deve guardar request_hash e response_hash sem payload sensivel bruto.",
|
|
"rule_id": "evidence.hashes-required",
|
|
"title": "Hashes de payload e resposta",
|
|
"validation": "Confirmar hashes preenchidos por probe."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"response_excerpt"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "redaction",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Evidencias nao podem conter cfat_, Authorization Bearer cru, tokens longos ou bearer numerico bruto.",
|
|
"rule_id": "redaction.no-secret-shapes",
|
|
"title": "Sem segredo bruto em evidencia",
|
|
"validation": "Varrer response_excerpt e campos textuais por formatos proibidos."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"rate_limit_per_minute"
|
|
],
|
|
"failure_status": "partial",
|
|
"kind": "rate_limit",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Probes automatizados devem respeitar limite padrao de 30 chamadas/minuto por ator.",
|
|
"rule_id": "rate-limit.default",
|
|
"title": "Limite operacional padrao",
|
|
"validation": "Registrar limite no contrato e bloquear suites que excedam o teto."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"log_retention_days"
|
|
],
|
|
"failure_status": "partial",
|
|
"kind": "retention",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Logs de evidencia operacional devem reter metadados redigidos por 30 dias.",
|
|
"rule_id": "retention.logs",
|
|
"title": "Retencao de logs",
|
|
"validation": "Registrar politica no artefato de acesso."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"origin",
|
|
"destination",
|
|
"tool",
|
|
"payload",
|
|
"actor",
|
|
"permission",
|
|
"result",
|
|
"traceId",
|
|
"auditId",
|
|
"timestamp"
|
|
],
|
|
"failure_status": "blocked",
|
|
"kind": "transit",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Fluxos interplataforma devem preservar origin, destination, tool, payload, actor, permission, result, traceId, auditId e timestamp.",
|
|
"rule_id": "transit.required-fields",
|
|
"title": "Ledger MCP obrigatorio",
|
|
"validation": "Validar campos exigidos no contrato de transito MCP."
|
|
},
|
|
{
|
|
"evidence_fields": [
|
|
"policy_version"
|
|
],
|
|
"failure_status": "partial",
|
|
"kind": "governance",
|
|
"owner": "tudo-para-ia-mcps-internos-plataform",
|
|
"required": true,
|
|
"requirement": "Falha ou aceite do plugin Cloudflare fica fora do diagnostico de Workers; trabalho real usa wrangler ou validacao HTTP live.",
|
|
"rule_id": "governance.plugin-not-operational-path",
|
|
"title": "Plugin Cloudflare nao substitui caminho operacional",
|
|
"validation": "Confirmar que o artefato nao transforma plugin em blocker operacional."
|
|
}
|
|
],
|
|
"secretSafe": true,
|
|
"status": "passed",
|
|
"summary": [
|
|
"Probes live avaliados: 4.",
|
|
"Probes live OK: 4/4.",
|
|
"Regras aprovadas: 12/12.",
|
|
"Bearer bruto persistido: False.",
|
|
"Falha do plugin Cloudflare nao e blocker operacional: True."
|
|
]
|
|
} |