@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/inventory/fetchRate.js

@@ -2,18 +2,21 @@
  * Per-host rate policy for batched registry fetches.
  *
  * This is the single source of truth for the JS transport's concurrency and
- * minimum-interval decisions. The numbers are shared with the Rust transport
+ * minimum-interval decisions. Every number is shared with the Rust transport
  * (`cdxgen-plugins-bin/thirdparty/cdxrs/src/fetch/rate.rs`); a change to one
  * side must be reflected in the other, and `fetchRate.poku.js` pins them so a
- * drift is visible.
+ * drift is visible. crates.io and package.elm-lang.org are routed so that their
+ * requests never reach the Rust transport, which makes this table the one that
+ * governs them in practice — their rows are mirrored there regardless, because
+ * two tables that disagree are a bug waiting for the routing to change.
  *
  * Why a per-host table rather than a single global interval: a single-registry
  * project — which is to say, almost every npm project — has exactly one host,
  * so a conservative per-host cap *is* the global cap. Applying crates.io's
- * 250 ms to every host caps an npm run at 4 requests per second, which is
- * slower than the serial JS path once connection reuse is taken into account.
- * Hosts that publish a limit get an interval; hosts that do not are bounded by
- * the per-host concurrency cap alone, and by whatever `Retry-After` they send.
+ * one-per-second policy to every host would cap an npm run at one request a
+ * second, orders of magnitude slower than that registry asks for. Hosts that
+ * publish a limit get an interval; hosts that do not are bounded by the
+ * per-host concurrency cap alone, and by whatever `Retry-After` they send.
  */
 
 import { readEnvironmentVariable } from "../core/activity.js";
@@ -48,13 +51,18 @@ import { readEnvironmentVariable } from "../core/activity.js";
  * Suffix match is used so `index.crates.io` inherits `crates.io`.
  */
 const HOST_POLICIES = [
-  // crates.io's published budget is per IP and does not improve with a token.
+  // crates.io's crawler policy asks for at most one request per second, made
+  // serially. It is a condition of use rather than a throughput hint, so the
+  // interval is a full second and the concurrency is 1: with more than one
+  // request in flight the gate would still average a second apiece but would
+  // deliver them in bursts, which is the thing the policy rules out. The
+  // budget is per IP and does not improve with a token.
   {
     host: "crates.io",
-    anonInterval: 250,
-    anonConcurrency: 4,
-    authInterval: 250,
-    authConcurrency: 4,
+    anonInterval: 1000,
+    anonConcurrency: 1,
+    authInterval: 1000,
+    authConcurrency: 1,
   },
   // GitHub: 60 req/h anonymous, 5000 req/h authenticated. The limit is an
   // hourly budget rather than a rate, so a batch of a few hundred lookups is
@@ -88,6 +96,61 @@ const HOST_POLICIES = [
     authInterval: 250,
     authConcurrency: 4,
   },
+  // package.elm-lang.org publishes no limit: its robots.txt carries no
+  // `Crawl-delay` and the registry has no terms of use or documented API. What
+  // it does have is a single community-run origin rather than a CDN, so it is
+  // held to the same gentle allowance as the other unpublished host in this
+  // table instead of the CDN default. Like crates.io, its requests are kept off
+  // the Rust transport to leave one gate in charge; rate.rs still carries the
+  // same row so the two tables state one policy.
+  // Maven Central publishes no numeric limit. What it publishes instead is a
+  // policy: consumption limits are enforced against aggregate traffic, the
+  // thresholds are unpublished and moving downward, and the named offenders are
+  // "CI/CD platforms, security scanners, and other services that generate
+  // outsized traffic" — which is cdxgen's exact job description. A block is an
+  // escalating ban of up to 30 days, not a per-request 429, so the cost of
+  // being slightly too fast is losing Maven resolution for a month rather than
+  // retrying a second later. That asymmetry, not a published number, is what
+  // sets these rows.
+  //
+  // repo1 is the artifact store: Cloudflare-fronted (`cf-cache-status` on every
+  // response), and a POM fetch that hits the edge cache never reaches Sonatype.
+  // It gets a real allowance — 100 ms and 8 in flight, so ~10 req/s sustained —
+  // which is half the CDN default and orders of magnitude below anything that
+  // would show up in the top few percent of Central's traffic.
+  {
+    host: "repo1.maven.org",
+    anonInterval: 100,
+    anonConcurrency: 8,
+    authInterval: 100,
+    authConcurrency: 8,
+  },
+  // The search API is the opposite: a Solr query against the origin, one
+  // request per unknown jar hash, cacheable by nobody. cdxgen already treats it
+  // as fragile — a single timeout or 429 disables jar search for the rest of
+  // the run — so the gate is a serial 500 ms (~2 req/s). A jar sweep stays
+  // usable while staying far below anything worth throttling.
+  {
+    host: "search.maven.org",
+    anonInterval: 500,
+    anonConcurrency: 1,
+    authInterval: 500,
+    authConcurrency: 1,
+  },
+  {
+    host: "central.sonatype.com",
+    anonInterval: 500,
+    anonConcurrency: 1,
+    authInterval: 500,
+    authConcurrency: 1,
+  },
+  {
+    host: "package.elm-lang.org",
+    anonInterval: 250,
+    anonConcurrency: 4,
+    authInterval: 250,
+    authConcurrency: 4,
+  },
 ];
 
 /**

package/lib/inventory/forgeEnricher.js

@@ -1,4 +1,5 @@
 import { cdxgenAgent, readEnvironmentVariable } from "../core/activity.js";
+import { getUserAgent } from "../core/userAgent.js";
 import { getOriginUrl } from "./envcontext.js";
 import { prefetchJson } from "./fetchBatch.js";
 
@@ -123,7 +124,7 @@ export async function enrichFromForge(dir, aiCommits, options = {}) {
     const githubHeaders = {
       Accept: "application/vnd.github+json",
       Authorization: `Bearer ${githubToken}`,
-      "User-Agent": "cdxgen-oversight",
+      "User-Agent": getUserAgent("api.github.com"),
     };
     const pullsUrlFor = (commit) =>
       `https://api.github.com/repos/${owner}/${repo}/commits/${commit.hash}/pulls`;
@@ -214,7 +215,7 @@ export async function enrichFromForge(dir, aiCommits, options = {}) {
     const commitsToQuery = aiCommits.slice(0, 5);
     const gitlabHeaders = {
       "PRIVATE-TOKEN": gitlabToken,
-      "User-Agent": "cdxgen-oversight",
+      "User-Agent": getUserAgent("gitlab.com"),
     };
     const mrUrlFor = (commit) =>
       `https://gitlab.com/api/v4/projects/${projectEncoded}/repository/commits/${commit.hash}/merge_requests`;

package/lib/inventory/jvmToolEnv.js

@@ -45,10 +45,11 @@ const JVM_BUILD_TOOL_CANDIDATES = ["maven", "gradle", "sbt", "scala"];
 
 /**
  * Anchored validator for sdkman version identifiers such as `3.9.9`,
- * `4.0.0-rc-5`, `8.14`, or `21.0.7-tem`. Versions are interpolated into a
- * shell command by the sdkman installer, so every identifier must be a single
- * safe token: it must start with a digit and may only contain digits, ascii
- * letters, dots, and hyphens.
+ * `4.0.0-rc-5`, `8.14`, `21.0.7-tem`, or `26.0.2+1.1-tem`. Versions are
+ * interpolated into a shell command by the sdkman installer, so every
+ * identifier must be a single safe token: it must start with a digit and may
+ * only contain digits, ascii letters, dots, hyphens, and plus signs (`+` has
+ * no shell meaning and sdkman uses it in Temurin respin identifiers).
  *
  * Every separator must be followed by at least one alphanumeric character, and
  * a single repeated group covers both the dotted numeric part and the vendor
@@ -63,7 +64,7 @@ export function isValidSdkmanVersion(version) {
     typeof version === "string" &&
     version.length > 0 &&
     version.length <= MAX_VERSION_TOKEN_LENGTH &&
-    /^\d+(?:[-.][0-9A-Za-z]+)*$/.test(version)
+    /^\d+(?:[-.+][0-9A-Za-z]+)*$/.test(version)
   );
 }
 

package/lib/inventory/mcpConfigParser.js

@@ -1,6 +1,8 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 
+import * as toml from "smol-toml";
+
 import {
   sanitizeBomPropertyValue,
   sanitizeBomUrl,
@@ -30,6 +32,16 @@ const MCP_CONFIG_PATTERNS = [
   "**/opencode.json",
   "opencode.jsonc",
   "**/opencode.jsonc",
+  ".gemini/settings.json",
+  "**/.gemini/settings.json",
+  ".windsurf/mcp_config.json",
+  "**/.windsurf/mcp_config.json",
+  ".zed/settings.json",
+  "**/.zed/settings.json",
+  ".roo/mcp.json",
+  "**/.roo/mcp.json",
+  ".codex/config.toml",
+  "**/.codex/config.toml",
 ];
 
 const LOCAL_TUNNEL_HOST_PATTERNS = [
@@ -92,11 +104,32 @@ function configFormat(filePath) {
   ) {
     return "cursor";
   }
+  if (lowerPath.includes("/.gemini/")) {
+    return "gemini";
+  }
+  if (lowerPath.includes("/.windsurf/")) {
+    return "windsurf";
+  }
+  if (lowerPath.includes("/.zed/")) {
+    return "zed";
+  }
+  if (lowerPath.includes("/.roo/")) {
+    return "roo";
+  }
+  if (
+    lowerPath.includes("/.codex/") ||
+    lowerPath.endsWith(".codex/config.toml")
+  ) {
+    return "codex";
+  }
   return "generic-mcp-json";
 }
 
 function syntaxForFile(filePath) {
   const lowerPath = filePath.toLowerCase();
+  if (lowerPath.endsWith(".toml")) {
+    return "toml";
+  }
   return lowerPath.endsWith(".json") || lowerPath.endsWith(".jsonc")
     ? "json"
     : "text";
@@ -105,7 +138,15 @@ function syntaxForFile(filePath) {
 function extractServerMaps(config) {
   const serverMaps = [];
   for (const [key, value] of Object.entries(config || {})) {
-    if (["mcpServers", "context_servers", "servers", "mcp"].includes(key)) {
+    if (
+      [
+        "mcpServers",
+        "context_servers",
+        "servers",
+        "mcp",
+        "mcp_servers",
+      ].includes(key)
+    ) {
       if (value && typeof value === "object" && !Array.isArray(value)) {
         serverMaps.push({ configKey: key, servers: Object.entries(value) });
       } else if (Array.isArray(value)) {
@@ -382,6 +423,106 @@ function trustProfile(officialSdk, exposureType, authPosture) {
   return officialSdk ? "official-sdk+unknown" : "review-needed";
 }
 
+/**
+ * Extract an explicit MCP protocol version literal from a server config.
+ *
+ * @param {Object} serverConfig Parsed server configuration
+ * @returns {string|undefined} protocol version such as `2026-07-28`
+ */
+function protocolVersionForConfig(serverConfig) {
+  const candidate =
+    serverConfig?.protocolVersion ||
+    serverConfig?.protocol_version ||
+    serverConfig?.["MCP-Protocol-Version"] ||
+    serverConfig?.mcpProtocolVersion;
+  if (typeof candidate === "string" && /^\d{4}-\d{2}-\d{2}$/u.test(candidate)) {
+    return candidate;
+  }
+  return undefined;
+}
+
+/**
+ * Detect MCP features deprecated by the 2026-07-28 specification that a config
+ * still references.
+ *
+ * Detection is structural rather than free-text: the transport type, an
+ * explicit dynamic client registration endpoint, and declared capability
+ * objects are reliable signals, whereas substring scans over a stringified
+ * config fire on server names and unrelated blocks. Wire-level method names
+ * (`roots/list`, `sampling/createMessage`) are exchanged at runtime and never
+ * appear in a client config stanza, so they are intentionally not matched
+ * here; source analysis is the right place for those.
+ *
+ * @param {Object} serverConfig Parsed server configuration
+ * @param {string} transport Resolved transport
+ * @returns {string[]} sorted list of deprecated feature labels
+ */
+function deprecatedFeaturesForConfig(serverConfig, transport) {
+  const found = new Set();
+  // Legacy HTTP+SSE transport.
+  if (transport === "sse") {
+    found.add("sse-transport");
+  }
+  // Dynamic client registration, detected from an explicit endpoint or flag.
+  if (
+    serverConfig?.registration_endpoint ||
+    serverConfig?.auth?.registration_endpoint ||
+    serverConfig?.oauth?.registration_endpoint ||
+    serverConfig?.dynamicClientRegistration === true ||
+    serverConfig?.supportsDCR === true
+  ) {
+    found.add("dynamic-client-registration");
+  }
+  // Capability objects the client explicitly declares. A capabilities block is
+  // the structured place these appear; a bare declaration of them is the
+  // deprecated shape under 2026-07-28.
+  const capabilities = serverConfig?.capabilities;
+  if (capabilities && typeof capabilities === "object") {
+    for (const feature of ["sampling", "logging", "roots"]) {
+      if (capabilities[feature] && typeof capabilities[feature] === "object") {
+        found.add(feature);
+      }
+    }
+  }
+  return Array.from(found).sort();
+}
+
+/**
+ * Detect Client ID Metadata Document (CIMD) usage in a server config.
+ *
+ * @param {Object} serverConfig Parsed server configuration
+ * @returns {boolean} true when CIMD is configured
+ */
+function usesClientIdMetadataDocument(serverConfig) {
+  return Boolean(
+    serverConfig?.clientIdMetadataDocument ||
+      serverConfig?.client_id_metadata_document ||
+      serverConfig?.clientIdMetadataDocumentEnabled ||
+      serverConfig?.client_id_metadata_document_enabled ||
+      serverConfig?.oauth?.clientIdMetadataDocument,
+  );
+}
+
+/**
+ * Detect whether a config binds tokens to a specific resource audience, per the
+ * hardened MCP 2026-07-28 authorization model.
+ *
+ * @param {Object} serverConfig Parsed server configuration
+ * @returns {boolean} true when audience-bound resource metadata is present
+ */
+function usesAudienceBoundTokens(serverConfig) {
+  const resourceMetadata =
+    serverConfig?.resourceMetadata || serverConfig?.oauth?.resourceMetadata;
+  if (resourceMetadata && typeof resourceMetadata === "object") {
+    return Boolean(
+      resourceMetadata.resource &&
+        (Array.isArray(resourceMetadata.authorization_servers) ||
+          resourceMetadata.authorizationServers),
+    );
+  }
+  return false;
+}
+
 function createServiceFromConfig(
   filePath,
   format,
@@ -511,6 +652,27 @@ function createServiceFromConfig(
   if (authHints.has("oauth")) {
     addUniqueProperty(properties, "cdx:mcp:auth:requiresOAuth", "true");
   }
+  if (usesClientIdMetadataDocument(serverConfig)) {
+    addUniqueProperty(properties, "cdx:mcp:auth:cimd", "true");
+  }
+  if (usesAudienceBoundTokens(serverConfig)) {
+    addUniqueProperty(properties, "cdx:mcp:auth:audienceBound", "true");
+  }
+  const protocolVersion = protocolVersionForConfig(serverConfig);
+  if (protocolVersion) {
+    addUniqueProperty(properties, "cdx:mcp:protocolVersion", protocolVersion);
+  }
+  const deprecatedFeatures = deprecatedFeaturesForConfig(
+    serverConfig,
+    transport,
+  );
+  if (deprecatedFeatures.length) {
+    addUniqueProperty(
+      properties,
+      "cdx:mcp:deprecatedFeatures",
+      deprecatedFeatures.join(","),
+    );
+  }
   if (
     serverConfig?.protectedResourceMetadata ||
     serverConfig?.resourceServerUrl ||
@@ -650,7 +812,9 @@ export const mcpConfigParser = {
       }
       let configJson;
       try {
-        configJson = parseJsonLike(raw);
+        configJson = filePath.toLowerCase().endsWith(".toml")
+          ? toml.parse(raw)
+          : parseJsonLike(raw);
       } catch {
         continue;
       }

package/lib/inventory/mcpDiscovery.js

@@ -6,6 +6,17 @@ const PROVIDER_TEXT_PATTERNS = [
   ["deepseek", /\bdeepseek\b/i],
   ["ollama", /\bollama\b/i],
   ["groq", /\bgroq\b/i],
+  ["xai", /\bgrok\b|\bx\.ai\b/i],
+  ["openrouter", /\bopenrouter\b/i],
+  // "bedrock" alone is also a WordPress stack and a Minecraft edition, so
+  // require AWS context before attributing it to Amazon Bedrock.
+  ["aws-bedrock", /\b(?:aws|amazon)[\s-]?bedrock\b|\bbedrock[\s-]?runtime\b/i],
+  ["cerebras", /\bcerebras\b/i],
+  // Drop the bare "kimi" alias (a common given name); keep the distinctive
+  // "moonshot" vendor token.
+  ["moonshot", /\bmoonshot\b/i],
+  ["zhipu", /\bzhipu\b|\bglm-[0-9]/i],
+  ["qwen", /\bqwen\b|\bdashscope\b/i],
 ];
 
 const INLINE_CREDENTIAL_PATTERNS = [