Perimeter-Sicherheit (Vor 2020)
    │
    ├── Firewalls
    ├── VPNs
    └── "Inside vs. Outside"
    │
    ▼
Zero Trust (2020-2025)
    │
    ├── "Never trust, always verify"
    ├── Identitäts-basierter Zugriff
    ├── Micro-Segmentierung
    └── Kontinuierliche Validierung
    │
    ▼
Agent-Aware-Sicherheit (2026+)
    │
    ├── Intent-Verifikation
    ├── Reasoning-Transparenz
    ├── Tool-Governance
    ├── Aktionsgrenzen
    ├── Verhaltens-Baselines
    └── Human-in-the-loop für Eskalation

# docker-compose.security-hardened.yml
version: '3.8'

services:
  n8n:
    image: n8nio/n8n:latest
    environment:
      # Security Hardening
      - N8N_SECURE_COOKIE=true
      - N8N_SECURITY_AUDIT_DAYS=30
      - N8N_BLOCK_ENV_ACCESS_IN_NODE=true
      - N8N_DEFAULT_BINARY_DATA_MODE=filesystem
      - N8N_DEFAULT_BINARY_DATA_FILESYSTEM_DIRECTORY_PATH=/data
      
      # Sandboxed Code Execution
      - N8N_CODE_SANDBOXED=true
      - N8N_CODE_EXECUTION_TIMEOUT=300000  # 5 Minuten
      - N8N_CODE_MEMORY_LIMIT=256  # MB
      
      # Execution
      - EXECUTIONS_MODE=queue
      - EXECUTIONS_TIMEOUT=3600
      - EXECUTIONS_TIMEOUT_MAX=7200
      
      # Redis für sicheres Queue-Management
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379
      
      # Verschlüsselung
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      
    volumes:
      - n8n_data:/home/node/.n8n
      - /tmp/n8n-binary-data:/data:rw,noexec,nosuid,nodev
      
    security_opt:
      - no-new-privileges:true
      
    cap_drop:
      - ALL
      
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
      
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m
      
    networks:
      - n8n-secure

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    networks:
      - n8n-secure

volumes:
  n8n_data:
  redis_data:

networks:
  n8n-secure:
    internal: true

// Input Validation Node
const validateInput = (input) => {
  const rules = {
    email: {
      pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
      maxLength: 254,
      sanitize: (val) => val.toLowerCase().trim()
    },
    phone: {
      pattern: /^\+?[\d\s-]{10,20}$/,
      maxLength: 20,
      sanitize: (val) => val.replace(/\s/g, '')
    },
    message: {
      maxLength: 5000,
      sanitize: (val) => {
        // Potenzielle XSS-Vektoren entfernen
        return val
          .replace(/<script[^>]*>.*?<\/script>/gi, '')
          .replace(/<[^>]+>/g, '')  // HTML-Tags entfernen
          .replace(/javascript:/gi, '')
          .replace(/on\w+\s*=/gi, '');  // Event-Handler entfernen
      }
    }
  };

  const validated = {};
  const errors = [];

  for (const [field, rule] of Object.entries(rules)) {
    if (input[field]) {
      // Länge prüfen
      if (rule.maxLength && input[field].length > rule.maxLength) {
        errors.push(`${field}: Maximallänge überschritten`);
        continue;
      }

      // Muster prüfen
      if (rule.pattern && !rule.pattern.test(input[field])) {
        errors.push(`${field}: Ungültiges Format`);
        continue;
      }

      // Sanitisieren
      validated[field] = rule.sanitize ? rule.sanitize(input[field]) : input[field];
    }
  }

  if (errors.length > 0) {
    return { valid: false, errors };
  }

  return { valid: true, data: validated };
};

const result = validateInput($input.first().json);

if (!result.valid) {
  return [{
    json: {
      error: 'Validierung fehlgeschlagen',
      details: result.errors,
      statusCode: 400
    }
  }];
}

return [{
  json: result.data
}];

// Rate Limiting Node (erfordert Redis)
const Redis = require('ioredis');

const redis = new Redis({
  host: process.env.REDIS_HOST,
  password: process.env.REDIS_PASSWORD,
  db: 1  // Separate DB für Rate Limiting
});

const rateLimit = async (identifier, rules) => {
  const now = Date.now();
  const key = `ratelimit:${identifier}`;
  
  // Mehrere Zeitfenster prüfen
  const windows = [
    { name: 'minute', ttl: 60 },
    { name: 'hour', ttl: 3600 },
    { name: 'day', ttl: 86400 }
  ];
  
  const results = {};
  
  for (const window of windows) {
    const windowKey = `${key}:${window.name}`;
    const current = await redis.incr(windowKey);
    
    if (current === 1) {
      await redis.expire(windowKey, window.ttl);
    }
    
    const limit = rules[window.name];
    results[window.name] = {
      current,
      limit,
      remaining: Math.max(0, limit - current),
      exceeded: current > limit
    };
  }
  
  // Prüfen, ob ein Limit überschritten wurde
  const exceeded = Object.values(results).some(r => r.exceeded);
  
  return {
    allowed: !exceeded,
    limits: results,
    retryAfter: exceeded ? 
      Math.min(...Object.values(results)
        .filter(r => r.exceeded)
        .map(r => r.reset)) : 0
  };
};

// Rate Limiting anwenden
const identifier = $input.first().json.headers['x-forwarded-for'] || 
                   $input.first().json.headers['x-real-ip'] ||
                   'unknown';

const rules = {
  minute: 60,    // 60 Anfragen pro Minute
  hour: 1000,    // 1000 Anfragen pro Stunde
  day: 10000     // 10000 Anfragen pro Tag
};

const limitResult = await rateLimit(identifier, rules);

if (!limitResult.allowed) {
  return [{
    json: {
      error: 'Rate Limit überschritten',
      limits: limitResult.limits,
      retryAfter: limitResult.retryAfter,
      statusCode: 429
    }
  }];
}

return [{
  json: {
    allowed: true,
    remaining: limitResult.limits.minute.remaining
  }
}];

// Datenklassifizierung und Maskierung
const classifyAndMask = (data) => {
  const patterns = {
    ssn: {
      pattern: /\b\d{3}-\d{2}-\d{4}\b/g,
      mask: (match) => `XXX-XX-${match.slice(-4)}`,
      classification: 'PII_HIGH'
    },
    creditCard: {
      pattern: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,
      mask: (match) => `XXXX-XXXX-XXXX-${match.slice(-4)}`,
      classification: 'PCI_DSS'
    },
    email: {
      pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
      mask: (match) => {
        const [local, domain] = match.split('@');
        return `${local[0]}***@${domain}`;
      },
      classification: 'PII_MEDIUM'
    },
    apiKey: {
      pattern: /\b(sk-[a-zA-Z0-9]{48}|Bearer\s+[a-zA-Z0-9_-]+)\b/gi,
      mask: () => '[MASKIERT]',
      classification: 'CREDENTIAL'
    }
  };

  let maskedData = JSON.stringify(data);
  const classifications = new Set();

  for (const [type, config] of Object.entries(patterns)) {
    const matches = maskedData.match(config.pattern);
    if (matches) {
      classifications.add(config.classification);
      maskedData = maskedData.replace(config.pattern, config.mask);
    }
  }

  return {
    original: data,
    masked: JSON.parse(maskedData),
    classifications: Array.from(classifications),
    requiresEncryption: classifications.has('PII_HIGH') || 
                       classifications.has('PCI_DSS')
  };
};

const input = $input.first().json;
const result = classifyAndMask(input);

// Klassifizierung loggen (ohne sensible Daten)
console.log('Datenklassifizierungen:', result.classifications);

// Maskierte Daten für Downstream-Verarbeitung zurückgeben
return [{
  json: {
    ...result.masked,
    _securityMeta: {
      classifications: result.classifications,
      requiresEncryption: result.requiresEncryption
    }
  }
}];

// Prompt Injection Erkennung und Prävention
const detectPromptInjection = (input) => {
  // Bekannte Injection-Muster
  const injectionPatterns = [
    /ignore\s+(?:previous|above|all)\s+instructions?/i,
    /disregard\s+(?:the|your|all)\s+(?:instructions?|system)/i,
    /system\s*:\s*/i,
    /\[system\s*:\s*/i,
    /you\s+are\s+now\s+/i,
    /from\s+now\s+on\s+you\s+are/i,
    /act\s+as\s+/i,
    /pretend\s+to\s+be/i,
    /DAN\s*\(|Do\s+Anything\s+Now/i,
    /jailbreak|prompt\s+leak/i,
    /\{\{[^}]+\}\}/g,  // Template Injection
    /<%[^%]+%>/g       // ERB/Template Injection
  ];

  const suspiciousKeywords = [
    'ignore', 'disregard', 'bypass', 'override',
    'secret', 'password', 'credential', 'token',
    'hidden', 'admin', 'root', 'sudo'
  ];

  const detections = [];

  // Injection-Muster prüfen
  for (const pattern of injectionPatterns) {
    if (pattern.test(input)) {
      detections.push({
        type: 'INJECTION_PATTERN',
        pattern: pattern.toString(),
        severity: 'HIGH'
      });
    }
  }

  // Keyword-Dichte prüfen
  const keywordCount = suspiciousKeywords.filter(kw => 
    input.toLowerCase().includes(kw)
  ).length;

  if (keywordCount >= 3) {
    detections.push({
      type: 'SUSPICIOUS_KEYWORDS',
      count: keywordCount,
      keywords: suspiciousKeywords.filter(kw => 
        input.toLowerCase().includes(kw)
      ),
      severity: 'MEDIUM'
    });
  }

  // Prüfung auf Delimiter-Missbrauch
  const delimiterCount = (input.match(/["'`<>{}\[\]]/g) || []).length;
  const inputLength = input.length;
  const delimiterRatio = delimiterCount / inputLength;

  if (delimiterRatio > 0.3) {
    detections.push({
      type: 'DELIMITER_ABUSE',
      ratio: delimiterRatio,
      severity: 'MEDIUM'
    });
  }

  return {
    isSafe: detections.length === 0,
    riskScore: detections.reduce((sum, d) => {
      return sum + (d.severity === 'HIGH' ? 10 : 5);
    }, 0),
    detections
  };
};

const userInput = $input.first().json.prompt || $input.first().json.message;
const scanResult = detectPromptInjection(userInput);

if (!scanResult.isSafe) {
  // Sicherheitsereignis loggen
  await $httpRequest({
    method: 'POST',
    url: process.env.SECURITY_WEBHOOK_URL,
    body: {
      event: 'PROMPT_INJECTION_DETECTED',
      timestamp: new Date().toISOString(),
      riskScore: scanResult.riskScore,
      detections: scanResult.detections,
      source: $input.first().json.source
    }
  });

  return [{
    json: {
      error: 'Sicherheitsverletzung erkannt',
      code: 'PROMPT_INJECTION',
      statusCode: 400
    }
  }];
}

return [{
  json: {
    sanitized: userInput,
    securityScan: 'PASSED'
  }
}];

// Tool Permission Governance
class ToolGovernance {
  constructor(agentProfile) {
    this.agentProfile = agentProfile;
    this.auditLog = [];
  }

  async canExecute(toolName, parameters, context) {
    const permission = this.agentProfile.tools[toolName];
    
    if (!permission) {
      return { allowed: false, reason: 'Tool nicht registriert' };
    }

    // Prüfen, ob Tool aktiviert ist
    if (!permission.enabled) {
      return { allowed: false, reason: 'Tool deaktiviert' };
    }

    // Rate Limits prüfen
    if (permission.rateLimit) {
      const withinLimit = await this.checkRateLimit(toolName);
      if (!withinLimit) {
        return { allowed: false, reason: 'Rate Limit überschritten' };
      }
    }

    // Parameter-Constraints prüfen
    if (permission.allowedParams) {
      const paramCheck = this.validateParameters(
        parameters, 
        permission.allowedParams
      );
      if (!paramCheck.valid) {
        return { 
          allowed: false, 
          reason: `Ungültige Parameter: ${paramCheck.errors.join(', ')}` 
        };
      }
    }

    // Kontext-Anforderungen prüfen
    if (permission.requiresContext) {
      for (const req of permission.requiresContext) {
        if (!context[req]) {
          return { 
            allowed: false, 
            reason: `Fehlender erforderlicher Kontext: ${req}` 
          };
        }
      }
    }

    // Genehmigungs-Anforderungen prüfen
    if (permission.requiresApproval) {
      const approvalStatus = await this.requestApproval(
        toolName, 
        parameters,
        permission.requiresApproval
      );
      if (!approvalStatus.granted) {
        return { 
          allowed: false, 
          reason: 'Genehmigung erforderlich, aber nicht erteilt',
          approvalStatus 
        };
      }
    }

    // Genehmigung loggen
    this.auditLog.push({
      timestamp: new Date().toISOString(),
      agent: this.agentProfile.id,
      tool: toolName,
      parameters: this.sanitizeForLog(parameters),
      context: context.requestId,
      decision: 'ALLOWED'
    });

    return { allowed: true };
  }

  validateParameters(params, allowedSchema) {
    const errors = [];
    
    for (const [key, value] of Object.entries(params)) {
      const schema = allowedSchema[key];
      
      if (!schema) {
        errors.push(`Unbekannter Parameter: ${key}`);
        continue;
      }

      if (schema.type && typeof value !== schema.type) {
        errors.push(`${key}: Erwartet ${schema.type}`);
      }

      if (schema.enum && !schema.enum.includes(value)) {
        errors.push(`${key}: Muss einer von ${schema.enum.join(', ')} sein`);
      }

      if (schema.maxLength && value.length > schema.maxLength) {
        errors.push(`${key}: Maximallänge überschritten`);
      }

      if (schema.pattern && !schema.pattern.test(value)) {
        errors.push(`${key}: Ungültiges Format`);
      }
    }

    return { valid: errors.length === 0, errors };
  }
}

// Verwendung in n8n
const agentProfile = {
  id: 'customer-support-agent',
  role: 'support',
  tools: {
    'database_query': {
      enabled: true,
      rateLimit: { requests: 100, window: '1m' },
      allowedParams: {
        table: { type: 'string', enum: ['tickets', 'customers', 'kb'] },
        action: { type: 'string', enum: ['select', 'count'] },
        where: { type: 'object' },
        limit: { type: 'number', max: 100 }
      },
      requiresContext: ['sessionId', 'userId'],
      requiresApproval: null
    },
    'send_email': {
      enabled: true,
      rateLimit: { requests: 10, window: '1m' },
      allowedParams: {
        to: { type: 'string', pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/ },
        template: { type: 'string', enum: ['welcome', 'reset', 'support'] }
      },
      requiresContext: ['userId'],
      requiresApproval: { threshold: 'manager', timeout: 300 }
    },
    'delete_database': {
      enabled: false  // Explizit deaktiviert
    }
  }
};

const governance = new ToolGovernance(agentProfile);

const toolRequest = $input.first().json;
const context = {
  requestId: $input.first().json.requestId,
  userId: $input.first().json.userId,
  sessionId: $input.first().json.sessionId
};

const authorization = await governance.canExecute(
  toolRequest.toolName,
  toolRequest.parameters,
  context
);

return [{
  json: authorization
}];

┌─────────────────────────────────────────────────────────────────┐
│                    Observability Pipeline                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐   │
│  │   Traces     │───▶│   Metriken   │───▶│   Logs       │   │
│  │  (OpenTelemetry)  │ (Prometheus) │    │  (Strukturiert)│  │
│  └──────────────┘    └──────────────┘    └──────────────┘   │
│         │                   │                   │              │
│         └───────────────────┼───────────────────┘              │
│                             │                                  │
│                    ┌────────▼────────┐                        │
│                    │    Langfuse      │                        │
│                    │  (LLM Observability)                     │
│                    └────────┬────────┘                        │
│                             │                                  │
│  ┌──────────────────────────▼──────────────────────────┐      │
│  │                   Analyse & Alerting              │      │
│  │  • Performance-Metriken  • Kosten-Tracking       │      │
│  │  • Qualitäts-Scores       • Fehler-Muster          │      │
│  │  • Latenz-Analyse         • Verhaltens-Anomalien  │      │
│  └────────────────────────────────────────────────────┘      │
└─────────────────────────────────────────────────────────────────┘

# docker-compose.langfuse.yml
version: '3.8'

services:
  langfuse:
    image: ghcr.io/langfuse/langfuse:latest
    ports:
      - "3000:3000"
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@postgres:5432/langfuse
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - SALT=${SALT}
      - NEXTAUTH_URL=http://localhost:3000
      - LANGFUSE_ENABLE_EXPERIMENTAL_FEATURES=false
    depends_on:
      - postgres
      - redis
    networks:
      - observability

  postgres:
    image: postgres:15-alpine
    environment:
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=langfuse
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - observability

  redis:
    image: redis:7-alpine
    networks:
      - observability

  # Optional: ClickHouse für High-Volume Event-Verarbeitung
  clickhouse:
    image: clickhouse/clickhouse-server:24
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    networks:
      - observability

volumes:
  postgres_data:
  clickhouse_data:

networks:
  observability:

// Langfuse Integration Node für n8n
const { Langfuse } = require('langfuse');

const langfuse = new Langfuse({
  publicKey: process.env.LANGFUSE_PUBLIC_KEY,
  secretKey: process.env.LANGFUSE_SECRET_KEY,
  baseUrl: process.env.LANGFUSE_BASE_URL || 'http://langfuse:3000'
});

// Trace-Wrapper für KI-Agenten-Workflows
const createTracedAgent = async (agentConfig) => {
  const trace = langfuse.trace({
    name: agentConfig.name,
    userId: agentConfig.userId,
    sessionId: agentConfig.sessionId,
    metadata: {
      workflow: agentConfig.workflow,
      version: agentConfig.version
    }
  });

  return {
    trace,
    
    // LLM-Aufrufe wrappen
    async llmCall(model, messages, options = {}) {
      const generation = trace.generation({
        name: 'llm-completion',
        model,
        input: messages,
        modelParameters: {
          temperature: options.temperature,
          maxTokens: options.maxTokens,
          topP: options.topP
        }
      });

      const startTime = Date.now();
      
      try {
        // Tatsächlichen LLM-Aufruf ausführen
        const response = await $httpRequest({
          method: 'POST',
          url: 'https://api.openai.com/v1/chat/completions',
          body: {
            model,
            messages,
            ...options
          },
          headers: {
            'Authorization': `Bearer ${process.env.OPENAI_API_KEY}`
          }
        });

        const latency = Date.now() - startTime;
        const tokens = response.usage;

        generation.end({
          output: response.choices[0].message,
          usage: {
            input: tokens.prompt_tokens,
            output: tokens.completion_tokens,
            total: tokens.total_tokens
          },
          metadata: {
            latency_ms: latency,
            finish_reason: response.choices[0].finish_reason
          }
        });

        return response;
      } catch (error) {
        generation.end({
          output: { error: error.message },
          level: 'ERROR',
          statusMessage: error.message
        });
        throw error;
      }
    },

    // Tool-Ausführungen wrappen
    async toolExecution(toolName, input) {
      const span = trace.span({
        name: `tool-${toolName}`,
        input
      });

      try {
        const result = await executeTool(toolName, input);
        
        span.end({
          output: result,
          metadata: {
            tool: toolName,
            execution_time_ms: Date.now() - span.startTime
          }
        });

        return result;
      } catch (error) {
        span.end({
          output: { error: error.message },
          level: 'ERROR'
        });
        throw error;
      }
    },

    // Trace bewerten
    async score(name, value, comment) {
      await langfuse.score({
        traceId: trace.id,
        name,
        value,
        comment
      });
    },

    // Trace finalisieren
    async finalize(output, level = 'DEFAULT') {
      trace.update({
        output,
        level
      });
      await langfuse.flush();
    }
  };
};

// Beispiel-Verwendung im Workflow
const agent = await createTracedAgent({
  name: 'customer-support-agent',
  userId: $input.first().json.customer_id,
  sessionId: $input.first().json.session_id,
  workflow: 'support-ticket-resolution',
  version: '2.3.1'
});

try {
  // LLM-Aufruf mit automatischem Tracing
  const llmResponse = await agent.llmCall('gpt-4o', [
    { role: 'system', content: 'Du bist ein hilfsbereiter Support-Agent.' },
    { role: 'user', content: $input.first().json.message }
  ]);

  // Tool-Ausführung mit Tracing
  const ticketInfo = await agent.toolExecution('get_ticket', {
    ticket_id: $input.first().json.ticket_id
  });

  // Ergebnis bewerten
  await agent.score('helpfulness', 0.9, 'Erste Antwort gelöst');

  // Finalisieren
  await agent.finalize({
    response: llmResponse.choices[0].message.content,
    ticket_updated: true
  });

  return [{
    json: {
      response: llmResponse.choices[0].message.content,
      trace_id: agent.trace.id
    }
  }];
} catch (error) {
  await agent.finalize({ error: error.message }, 'ERROR');
  throw error;
}

// Anomalieerkennung für KI-Workflows
const analyzeWorkflow = async (traceData) => {
  const alerts = [];

  // Kosten-Anomalieerkennung
  const avgCost = await getAverageCost(traceData.workflow, '24h');
  if (traceData.cost > avgCost * 3) {
    alerts.push({
      severity: 'HIGH',
      type: 'COST_ANOMALY',
      message: `Kosten $${traceData.cost.toFixed(4)} überschreiten 3x Durchschnitt ($${avgCost.toFixed(4)})`,
      traceId: traceData.traceId
    });
  }

  // Latenz-Anomalie
  const avgLatency = await getAverageLatency(traceData.workflow, '24h');
  if (traceData.duration > avgLatency * 5) {
    alerts.push({
      severity: 'MEDIUM',
      type: 'LATENCY_ANOMALY',
      message: `Dauer ${traceData.duration}ms überschreitet 5x Durchschnitt (${avgLatency}ms)`,
      traceId: traceData.traceId
    });
  }

  // Token-Verbrauchs-Anomalie
  const avgTokens = await getAverageTokens(traceData.workflow, '24h');
  const totalTokens = traceData.tokenUsage.input + traceData.tokenUsage.output;
  if (totalTokens > avgTokens * 4) {
    alerts.push({
      severity: 'MEDIUM',
      type: 'TOKEN_ANOMALY',
      message: `Token-Verbrauch ${totalTokens} überschreitet 4x Durchschnitt (${avgTokens})`,
      traceId: traceData.traceId
    });
  }

  // Fehlerrate prüfen
  const recentErrors = await getRecentErrors(traceData.workflow, '1h');
  if (recentErrors.count > 10) {
    alerts.push({
      severity: 'CRITICAL',
      type: 'ERROR_SPIKE',
      message: `${recentErrors.count} Fehler in der letzten Stunde`,
      traceId: traceData.traceId
    });
  }

  // Alerts senden
  for (const alert of alerts) {
    await $httpRequest({
      method: 'POST',
      url: process.env.ALERT_WEBHOOK_URL,
      body: alert
    });
  }

  return alerts;
};

// MCP Server Governance
class MCPGovernance {
  constructor(config) {
    this.allowedServers = config.allowedServers || [];
    this.serverMetadata = new Map();
    this.auditLog = [];
  }

  async verifyServer(serverUrl) {
    // Allowlist prüfen
    const allowed = this.allowedServers.find(s => 
      serverUrl.startsWith(s.url)
    );
    
    if (!allowed) {
      throw new Error(`MCP Server nicht allowlisted: ${serverUrl}`);
    }

    // Server-Identität verifizieren
    const challenge = crypto.randomBytes(32).toString('hex');
    
    const response = await $httpRequest({
      method: 'POST',
      url: `${serverUrl}/verify`,
      body: { challenge }
    });

    if (!this.verifyChallengeResponse(challenge, response)) {
      throw new Error('MCP Server-Verifikation fehlgeschlagen');
    }

    // Tool-Definitionen abrufen und validieren
    const tools = await $httpRequest({
      method: 'GET',
      url: `${serverUrl}/tools`
    });

    const validatedTools = await this.validateToolDefinitions(tools);

    this.serverMetadata.set(serverUrl, {
      allowed: true,
      verified: true,
      tools: validatedTools,
      permissions: allowed.permissions,
      lastVerified: new Date().toISOString()
    });

    return validatedTools;
  }

  validateToolDefinitions(tools) {
    return tools.map(tool => {
      // Schema validieren
      if (!tool.name || !tool.description || !tool.inputSchema) {
        throw new Error(`Ungültige Tool-Definition: ${tool.name || 'unnamed'}`);
      }

      // Auf gefährliche Muster prüfen
      const dangerousPatterns = [
        /exec\s*\(/i,
        /eval\s*\(/i,
        /system\s*\(/i,
        /child_process/i
      ];

      const toolString = JSON.stringify(tool);
      for (const pattern of dangerousPatterns) {
        if (pattern.test(toolString)) {
          throw new Error(`Gefährliches Muster in Tool erkannt: ${tool.name}`);
        }
      }

      return {
        ...tool,
        riskLevel: this.assessRiskLevel(tool)
      };
    });
  }

  assessRiskLevel(tool) {
    const highRiskKeywords = [
      'delete', 'remove', 'drop', 'truncate',
      'execute', 'run', 'exec', 'eval',
      'write', 'modify', 'update'
    ];

    const toolString = JSON.stringify(tool).toLowerCase();
    const riskCount = highRiskKeywords.filter(kw => 
      toolString.includes(kw)
    ).length;

    if (riskCount >= 3) return 'HIGH';
    if (riskCount >= 1) return 'MEDIUM';
    return 'LOW';
  }

  async executeTool(serverUrl, toolName, parameters, context) {
    const server = this.serverMetadata.get(serverUrl);
    
    if (!server || !server.verified) {
      throw new Error('Server nicht verifiziert');
    }

    const tool = server.tools.find(t => t.name === toolName);
    
    if (!tool) {
      throw new Error(`Tool nicht gefunden: ${toolName}`);
    }

    // Berechtigungen prüfen
    const requiredPerm = `tool:${toolName}`;
    if (!server.permissions.includes(requiredPerm) && 
        !server.permissions.includes('tool:*')) {
      throw new Error(`Berechtigung verweigert: ${requiredPerm}`);
    }

    // Zusätzliche Genehmigung für High-Risk-Tools
    if (tool.riskLevel === 'HIGH') {
      const approved = await this.requestHumanApproval({
        server: serverUrl,
        tool: toolName,
        parameters,
        context
      });
      
      if (!approved) {
        throw new Error('High-Risk-Tool-Ausführung abgelehnt');
      }
    }

    // Ausführen mit Timeout und Logging
    const startTime = Date.now();
    
    try {
      const result = await Promise.race([
        $httpRequest({
          method: 'POST',
          url: `${serverUrl}/tools/${toolName}`,
          body: parameters,
          headers: {
            'X-Request-Context': JSON.stringify(context)
          }
        }),
        new Promise((_, reject) => 
          setTimeout(() => reject(new Error('Timeout')), 30000)
        )
      ]);

      this.auditLog.push({
        timestamp: new Date().toISOString(),
        action: 'TOOL_EXECUTE',
        server: serverUrl,
        tool: toolName,
        parameters: this.sanitizeForLog(parameters),
        duration_ms: Date.now() - startTime,
        success: true
      });

      return result;

    } catch (error) {
      this.auditLog.push({
        timestamp: new Date().toISOString(),
        action: 'TOOL_EXECUTE',
        server: serverUrl,
        tool: toolName,
        error: error.message,
        success: false
      });
      throw error;
    }
  }
}

// Verwendung in n8n
const governance = new MCPGovernance({
  allowedServers: [
    {
      url: 'https://mcp.company.com',
      permissions: ['tool:read_*', 'tool:search_*'],
      requireApproval: ['tool:write_*', 'tool:delete_*']
    },
    {
      url: 'https://mcp.salesforce.com',
      permissions: ['tool:crm_*'],
      requireApproval: []
    }
  ]
});

// Server verifizieren und verwenden
const tools = await governance.verifyServer('https://mcp.company.com');
const result = await governance.executeTool(
  'https://mcp.company.com',
  'search_documents',
  { query: $input.first().json.searchQuery },
  { userId: $input.first().json.user_id, requestId: generateUUID() }
);