Dev

.github/workflows/cd.yaml

@@ -12,11 +12,11 @@ jobs:
       version: ${{ steps.version.outputs.value }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '22.x'
+          node-version: '24.x'
       - name: Get package version
         id: version
         run: echo "value=$(node -p -e "require('./package.json').version")" >> "$GITHUB_OUTPUT"
@@ -29,7 +29,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - run: gh release create v${{ needs.extract_version.outputs.version }} --generate-notes -t "Version ${{ needs.extract_version.outputs.version }}"
         env:
           GITHUB_TOKEN: ${{ github.TOKEN }}
@@ -41,27 +41,25 @@ jobs:
     needs:
       - create_release
       - extract_version
-
     permissions:
-      contents: 'read'
-      id-token: 'write'
-
+      id-token: write
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Setup npmrc
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '22.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
+      - name: Update npm
+        run: npm install -g npm@11.6.2
       - name: Install dependencies
         run: npm install
       - name: Build
         run: npm run build
       - name: Publish package to NPM
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Setup Docker
         uses: docker/setup-buildx-action@v3

.github/workflows/ci.yaml

@@ -5,7 +5,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
       - name: Install dependencies
         run: npm ci
       - name: Build
@@ -14,7 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
       - name: Install dependencies
         run: npm ci
       - name: Run linter
@@ -23,7 +31,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
       - name: Install dependencies
         run: npm ci
       - name: Run unit tests

CHANGELOG.md

@@ -5,12 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [1.1.1] - 2026-07-02
+
+### Fixed
+
+* Corrected version numbering: `1.1.0` was inadvertently published to npm ahead of the `1.0.x` line and superseded by subsequent `1.0.x` releases, leaving the registry with out-of-order versions. Bumping to `1.1.1` restores strictly increasing semantic versioning going forward.
+
+## [1.0.5] - 2026-07-01
+
+### Changed
+
+* Adjusted traffic data tool to new backend routes
+
+## [1.0.4] - 2025-09-09
+
+### Fixed
+
+* Fixed service account permissions
+
 ## [1.0.3] - 2025-09-09
 
 ### Changed
 
 * Docker container registry location
-* 
+
 ## [1.0.2] - 2025-09-08
 
 ### Fixed

README.md

@@ -23,10 +23,15 @@ Supercharge your AI workflows with comprehensive cybersecurity intelligence from
 - **Custom Security Rules**: Manage and audit your custom mitigation policies and security controls
 
 **Code Defender - Client-Side Security**
-- **Supply Chain Protection**: Monitor third-party scripts and vendors on your payment and sensitive pages
-- **PCI DSS Compliance**: Automated compliance validation and security assessment for payment environments
-- **Security Incident Response**: Track client-side attacks, XSS attempts, and code injection threats
-- **HTTP Security Headers**: Comprehensive security posture analysis and misconfiguration detection
+- **Client-Side Supply Chain Protection**: Monitor first- and third-party scripts and vendors on your payment and sensitive pages
+- **PCI DSS Compliance**: Streamline PCI DSS compliance and confirm that your site is not susceptible to attacks from scripts
+- **Security Incident Monitoring**: Track client-side attacks, e-skimming attempts, and code injection threats
+- **HTTP Security-Impacting Headers**: Monitor and alert personnel to changes to security-impacting HTTP headers
+
+## 🔑 Prerequisites
+
+* If running with NPM, download and install [Node.js](https://nodejs.org/en/download).
+* If running with Docker, download and install [Docker](https://www.docker.com/get-started/).
 
 ## 🚀 Quick Start
 
@@ -58,7 +63,7 @@ You'll need API tokens from your HUMAN Security account to access the services.
 
 ## 🐳 Run with Docker
 
-If you prefer Docker over NPM, run the MCP server container directly:
+If you prefer to use Docker over NPM, run the MCP server container directly:
 
 ```bash
 docker run --rm -i \
@@ -93,6 +98,7 @@ To use Docker from your MCP client config (e.g., Cursor or Claude Desktop), repl
 - **`HUMAN_API_HOST`**: Use a different API endpoint (default: `api.humansecurity.com`)
 - **`HUMAN_API_VERSION`**: Specify API version (default: `v1`)
 - **`HTTP_TIMEOUT_MS`**: Request timeout in milliseconds (default: `30000`)
+- **`HUMAN_TRAFFIC_API_BASE`**: Override the base URL for traffic data endpoints. Useful for local development against a pxPortal instance (e.g. `http://localhost:3000/api/v1/botDefender/traffic`). When not set, defaults to the standard HUMAN API base.
 
 ## 💡 Usage Examples
 
@@ -101,22 +107,22 @@ To use Docker from your MCP client config (e.g., Cursor or Claude Desktop), repl
 * *"Show me attack trends over the last 24 hours"*
 * *"Investigate suspicious activity for account ID XXXXX"*
 * *"What third-party scripts are running on our payment pages?"*
-* *"Are we PCI DSS compliant based on our current security headers?"*
+* *"Show me the scripts and headers in my PCI inventory"*
 * *"Analyze the effectiveness of our custom security rules"*
 * *"Show me details about attack cluster XXXXX"*
 
 ## 📊 Available Tools
 
 ### Cyberfraud Protection
-- **Traffic Data**: Comprehensive traffic analytics with security metrics
+- **Traffic Data**: Comprehensive traffic analytics with overtime time-series, aggregated metrics, and ranked tops breakdowns
 - **Attack Reporting (Overtime)**: Time-series attack analytics and trend analysis
 - **Attack Reporting (Overview)**: Detailed attack cluster intelligence and forensics
 - **Account Information**: Individual account security analysis and incident tracking
 - **Custom Rules**: Security policy management and effectiveness analysis
 
 ### Code Defender Security
 - **Security Incidents**: Client-side attack detection and investigation
-- **Script Inventory**: Third-party script monitoring and PCI compliance
+- **Script Inventory**: First- and third-party script monitoring and PCI compliance
 - **Header Inventory**: HTTP security header analysis and optimization
 
 ## 🔗 Integration Options
@@ -150,12 +156,52 @@ If you only need one service, you can configure just that token:
 }
 ```
 
+## 🧪 Local Development & Testing
+
+### Running against a local pxPortal instance
+
+To test the MCP server against a locally running pxPortal (default port `3000`), set `HUMAN_TRAFFIC_API_BASE` to override the traffic data endpoint:
+
+```json
+{
+  "mcpServers": {
+    "human-security": {
+      "command": "node",
+      "args": ["/path/to/human-mcp-server/dist/index.cjs"],
+      "env": {
+        "HUMAN_CYBERFRAUD_API_TOKEN": "your-token",
+        "HUMAN_TRAFFIC_API_BASE": "http://localhost:3000/api/v1/botDefender/traffic"
+      }
+    }
+  }
+}
+```
+
+### End-to-end test script
+
+`scripts/test_local.mjs` spawns the MCP server and runs 25 scenarios against a live backend, covering all modes (`overtime`, `metrics`, `tops`), filters, combined calls, time ranges, and tops field coverage.
+
+```bash
+# Build first
+npm run build
+
+# Run all scenarios against localhost:3000
+HUMAN_CYBERFRAUD_API_TOKEN=<token> node scripts/test_local.mjs
+
+# Run against a custom backend
+HUMAN_CYBERFRAUD_API_TOKEN=<token> \
+HUMAN_TRAFFIC_API_BASE=http://my-host/api/v1/botDefender/traffic \
+node scripts/test_local.mjs
+```
+
+Expected output: `RESULTS: 25 passed, 0 failed`.
+
 ## 🆘 Support
 
 - **Documentation**: [HUMAN Security Documentation](https://docs.humansecurity.com)
 - **API Tokens**:
-  - [Cyberfraud](https://docs.humansecurity.com/applications-and-accounts/reference/api-authentication#getting-a-token-for-account-defender-bot-defender-or-credential-intelligence)
-  - [Code Defender](https://docs.humansecurity.com/applications-and-accounts/reference/api-authentication#getting-a-token-for-code-defender-or-pci-dss)
+  - [Cyberfraud](https://docs.humansecurity.com/applications/reference/authentication#getting-a-token-for-the-account-defender-adaptive-feedback-bot-defender-or-credential-intelligence-api)
+  - [Code Defender](https://docs.humansecurity.com/applications/reference/authentication#getting-a-token-for-the-code-defender-or-pci-dss-api)
 - **Technical Support**: Available through your HUMAN Security support channels
 
 ## 📄 License