Protokoll #4301

{
    "event": "PreToolUse",
    "tool_name": "mcp__mcp-contracts__contracts_update",
    "tool_input": {
        "id": 8,
        "yaml_content": "contract:\n  name: \"db-access-security-protocol\"\n  version: \"2.0\"\n  status: \"active\"\n  description: \"Mehrstufiges Sicherheitsprotokoll gegen direkte DB-Zugriffe\"\n  created: \"2025-12-20\"\n  author: \"mcp-contracts\"\n\n  scope:\n    paths:\n      - \"\/src\/**\/*.php\"\n      - \"\/app\/**\/*.php\"\n      - \"\/opt\/scripts\/**\/*.py\"\n      - \"\/opt\/scripts\/**\/*.sh\"\n    excludes:\n      - \"\/tests\/**\"\n\n  rules:\n    # Bash-Befehle blockieren\n    - id: \"no-mysql-user\"\n      check_type: \"forbidden_pattern\"\n      patterns:\n        - \"mysql -u\"\n        - \"mysql -p\"\n        - \"mysql --user\"\n        - \"mysql --password\"\n      in_files: \"**\/*.sh\"\n      severity: \"critical\"\n      description: \"Keine direkten mysql-Befehle mit User\/Passwort\"\n\n    - id: \"no-mariadb-user\"\n      check_type: \"forbidden_pattern\"\n      patterns:\n        - \"mariadb -u\"\n        - \"mariadb -p\"\n        - \"mariadb --user\"\n        - \"mariadb --password\"\n      in_files: \"**\/*.sh\"\n      severity: \"critical\"\n      description: \"Keine direkten mariadb-Befehle mit User\/Passwort\"\n\n    - id: \"no-mysqldump\"\n      check_type: \"forbidden_pattern\"\n      patterns:\n        - \"mysqldump\"\n        - \"mysqlimport\"\n        - \"mysqladmin\"\n      in_files: \"**\/*.sh\"\n      severity: \"critical\"\n      description: \"Keine mysql-Admin-Tools direkt ausführen\"\n\n    - id: \"no-password-in-command\"\n      check_type: \"forbidden_pattern\"\n      patterns:\n        - \"--password=\"\n        - \"-p'\"\n        - '-p\"'\n      in_files: \"**\/*\"\n      severity: \"critical\"\n      description: \"Niemals Passwörter in Befehlen\"\n\n    # PHP-Zugriffe\n    - id: \"no-pdo-in-controller\"\n      check_type: \"forbidden_pattern\"\n      patterns:\n        - \"new PDO(\"\n        - \"->query(\"\n        - \"->prepare(\"\n      in_files: \"Controller\/**\/*.php\"\n      severity: \"critical\"\n      description: \"Controller dürfen kein direktes PDO verwenden\"\n\n    - id: \"pdo-only-in-infrastructure\"\n      check_type: \"dependency_check\"\n      forbidden_imports:\n        - \"PDO\"\n      in_files: \"Domain\/**\/*.php\"\n      severity: \"critical\"\n      description: \"Domain-Layer darf keine PDO-Abhängigkeit haben\"\n\n  enforcement:\n    on_violation: \"block\"\n    hook: \"\/var\/www\/tools\/ki-protokoll\/claude-hook\/block_direct_db.py\"\n\n  alternatives:\n    mcp_tools:\n      - tool: \"mcp__mcp-db__db_select\"\n        use_for: \"SELECT-Abfragen\"\n      - tool: \"mcp__mcp-db__db_schema\"\n        use_for: \"Tabellenstruktur\"\n      - tool: \"mcp__mcp-db__db_insert\"\n        use_for: \"INSERT-Operationen\"\n      - tool: \"mcp__mcp-db__db_update\"\n        use_for: \"UPDATE-Operationen\"\n      - tool: \"mcp__mcp-db__db_delete\"\n        use_for: \"DELETE-Operationen\"\n    allowed_databases:\n      - ki_dev\n      - ki_content\n\n  pass_threshold:\n    critical_max: 0\n    major_max: 0\n    minor_max: 0\n",
        "new_version": "2.0",
        "change_description": "Migration auf Meta-Schema v2.0: identity\/prevention\/detection → contract mit scope.paths und rules im check_type-Format",
        "changed_by": "claude"
    }
}

{
    "tool_response": [
        {
            "type": "text",
            "text": "{\n  \"success\": true,\n  \"contract\": {\n    \"id\": 8,\n    \"uuid\": \"fa19a7ba-5106-4feb-be67-660132e207ce\",\n    \"name\": \"db-access-security-protocol\",\n    \"version\": \"2.0\",\n    \"status\": \"active\",\n    \"yaml_content\": \"contract:\\n  name: \\\"db-access-security-protocol\\\"\\n  version: \\\"2.0\\\"\\n  status: \\\"active\\\"\\n  description: \\\"Mehrstufiges Sicherheitsprotokoll gegen direkte DB-Zugriffe\\\"\\n  created: \\\"2025-12-20\\\"\\n  author: \\\"mcp-contracts\\\"\\n\\n  scope:\\n    paths:\\n      - \\\"\/src\/**\/*.php\\\"\\n      - \\\"\/app\/**\/*.php\\\"\\n      - \\\"\/opt\/scripts\/**\/*.py\\\"\\n      - \\\"\/opt\/scripts\/**\/*.sh\\\"\\n    excludes:\\n      - \\\"\/tests\/**\\\"\\n\\n  rules:\\n    # Bash-Befehle blockieren\\n    - id: \\\"no-mysql-user\\\"\\n      check_type: \\\"forbidden_pattern\\\"\\n      patterns:\\n        - \\\"mysql -u\\\"\\n        - \\\"mysql -p\\\"\\n        - \\\"mysql --user\\\"\\n        - \\\"mysql --password\\\"\\n      in_files: \\\"**\/*.sh\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Keine direkten mysql-Befehle mit User\/Passwort\\\"\\n\\n    - id: \\\"no-mariadb-user\\\"\\n      check_type: \\\"forbidden_pattern\\\"\\n      patterns:\\n        - \\\"mariadb -u\\\"\\n        - \\\"mariadb -p\\\"\\n        - \\\"mariadb --user\\\"\\n        - \\\"mariadb --password\\\"\\n      in_files: \\\"**\/*.sh\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Keine direkten mariadb-Befehle mit User\/Passwort\\\"\\n\\n    - id: \\\"no-mysqldump\\\"\\n      check_type: \\\"forbidden_pattern\\\"\\n      patterns:\\n        - \\\"mysqldump\\\"\\n        - \\\"mysqlimport\\\"\\n        - \\\"mysqladmin\\\"\\n      in_files: \\\"**\/*.sh\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Keine mysql-Admin-Tools direkt ausführen\\\"\\n\\n    - id: \\\"no-password-in-command\\\"\\n      check_type: \\\"forbidden_pattern\\\"\\n      patterns:\\n        - \\\"--password=\\\"\\n        - \\\"-p'\\\"\\n        - '-p\\\"'\\n      in_files: \\\"**\/*\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Niemals Passwörter in Befehlen\\\"\\n\\n    # PHP-Zugriffe\\n    - id: \\\"no-pdo-in-controller\\\"\\n      check_type: \\\"forbidden_pattern\\\"\\n      patterns:\\n        - \\\"new PDO(\\\"\\n        - \\\"->query(\\\"\\n        - \\\"->prepare(\\\"\\n      in_files: \\\"Controller\/**\/*.php\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Controller dürfen kein direktes PDO verwenden\\\"\\n\\n    - id: \\\"pdo-only-in-infrastructure\\\"\\n      check_type: \\\"dependency_check\\\"\\n      forbidden_imports:\\n        - \\\"PDO\\\"\\n      in_files: \\\"Domain\/**\/*.php\\\"\\n      severity: \\\"critical\\\"\\n      description: \\\"Domain-Layer darf keine PDO-Abhängigkeit haben\\\"\\n\\n  enforcement:\\n    on_violation: \\\"block\\\"\\n    hook: \\\"\/var\/www\/tools\/ki-protokoll\/claude-hook\/block_direct_db.py\\\"\\n\\n  alternatives:\\n    mcp_tools:\\n      - tool: \\\"mcp__mcp-db__db_select\\\"\\n        use_for: \\\"SELECT-Abfragen\\\"\\n      - tool: \\\"mcp__mcp-db__db_schema\\\"\\n        use_for: \\\"Tabellenstruktur\\\"\\n      - tool: \\\"mcp__mcp-db__db_insert\\\"\\n        use_for: \\\"INSERT-Operationen\\\"\\n      - tool: \\\"mcp__mcp-db__db_update\\\"\\n        use_for: \\\"UPDATE-Operationen\\\"\\n      - tool: \\\"mcp__mcp-db__db_delete\\\"\\n        use_for: \\\"DELETE-Operationen\\\"\\n    allowed_databases:\\n      - ki_dev\\n      - ki_content\\n\\n  pass_threshold:\\n    critical_max: 0\\n    major_max: 0\\n    minor_max: 0\\n\",\n    \"scope_description\": \"Blockiert direkte mysql\/mariadb-Befehle via Bash\",\n    \"created_at\": \"2025-12-20T17:59:06\",\n    \"created_by\": \"mcp-contracts\",\n    \"updated_at\": \"2025-12-22T09:45:11\"\n  },\n  \"message\": \"Contract updated to v2.0\"\n}"
        }
    ]
}