@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (155) hide show
  1. package/CHANGELOG.md +274 -0
  2. package/bin/agentic-security.js +78 -1
  3. package/dist/178.index.js +1 -1
  4. package/dist/384.index.js +1 -1
  5. package/dist/415.index.js +90 -0
  6. package/dist/444.index.js +89 -0
  7. package/dist/503.index.js +288 -0
  8. package/dist/637.index.js +15 -1
  9. package/dist/838.index.js +1 -1
  10. package/dist/985.index.js +5 -1
  11. package/dist/agentic-security.mjs +18 -18
  12. package/dist/agentic-security.mjs.sha256 +1 -1
  13. package/package.json +13 -8
  14. package/src/dataflow/CLAUDE.md +1 -1
  15. package/src/dataflow/catalog.js +50 -11
  16. package/src/dataflow/engine.js +76 -1
  17. package/src/dataflow/implicit-flow.js +4 -2
  18. package/src/dataflow/index.js +9 -4
  19. package/src/dataflow/proof-gate.js +5 -0
  20. package/src/dataflow/summaries.js +19 -1
  21. package/src/engine.js +95 -7
  22. package/src/ir/parser-go.js +8 -0
  23. package/src/mcp/tools.js +6 -2
  24. package/src/posture/fix-history.js +24 -0
  25. package/src/posture/provenance.js +39 -0
  26. package/src/posture/sca-verdict.js +130 -0
  27. package/src/posture/secret-history.js +72 -0
  28. package/src/pr-delta.js +13 -0
  29. package/src/report/index.js +50 -0
  30. package/src/sast/agent-untrusted-flow.js +107 -0
  31. package/src/sast/api-authz.js +71 -0
  32. package/src/sast/cross-service.js +98 -0
  33. package/src/sast/event-entrypoint.js +90 -0
  34. package/src/sast/iac-terraform.js +107 -0
  35. package/src/sast/rbac-consistency.js +113 -0
  36. package/src/sast/wrong-context-sanitizer.js +55 -0
  37. package/src/sca/image-packages.js +74 -0
  38. package/src/sca/import-reachability.js +271 -0
  39. package/src/sca/install-script-analysis.js +82 -0
  40. package/bin/.agentic-security/findings.json +0 -1907
  41. package/bin/.agentic-security/last-scan.json +0 -1907
  42. package/bin/.agentic-security/last-scan.json.sig +0 -1
  43. package/bin/.agentic-security/scan-history.json +0 -166
  44. package/bin/.agentic-security/streak.json +0 -20
  45. package/src/.agentic-security/dpia.md +0 -26
  46. package/src/.agentic-security/findings.json +0 -117732
  47. package/src/.agentic-security/last-scan.json +0 -117732
  48. package/src/.agentic-security/last-scan.json.sig +0 -1
  49. package/src/.agentic-security/pqc-migration-plan.json +0 -80
  50. package/src/.agentic-security/pqc-migration-plan.md +0 -32
  51. package/src/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  52. package/src/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  53. package/src/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  54. package/src/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  55. package/src/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  56. package/src/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  57. package/src/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  58. package/src/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  59. package/src/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  60. package/src/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  61. package/src/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  62. package/src/.agentic-security/scan-history.json +0 -12946
  63. package/src/.agentic-security/streak.json +0 -21
  64. package/src/.agentic-security/threat-model.json +0 -3702
  65. package/src/.agentic-security/threat-model.md +0 -118
  66. package/src/dataflow/.agentic-security/dpia.md +0 -26
  67. package/src/dataflow/.agentic-security/findings.json +0 -6086
  68. package/src/dataflow/.agentic-security/last-scan.json +0 -6086
  69. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  70. package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json +0 -6
  71. package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  72. package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  73. package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json +0 -6
  74. package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  75. package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  76. package/src/dataflow/.agentic-security/scan-history.json +0 -250
  77. package/src/dataflow/.agentic-security/streak.json +0 -21
  78. package/src/dataflow/.agentic-security/threat-model.json +0 -161
  79. package/src/dataflow/.agentic-security/threat-model.md +0 -43
  80. package/src/ir/.agentic-security/dpia.md +0 -26
  81. package/src/ir/.agentic-security/exploit-bundles.json +0 -77
  82. package/src/ir/.agentic-security/findings.json +0 -4011
  83. package/src/ir/.agentic-security/last-scan.json +0 -4011
  84. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  85. package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  86. package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json +0 -6
  87. package/src/ir/.agentic-security/scan-history.json +0 -193
  88. package/src/ir/.agentic-security/streak.json +0 -20
  89. package/src/ir/.agentic-security/threat-model.json +0 -143
  90. package/src/ir/.agentic-security/threat-model.md +0 -39
  91. package/src/mcp/.agentic-security/findings.json +0 -8632
  92. package/src/mcp/.agentic-security/last-scan.json +0 -8632
  93. package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
  94. package/src/mcp/.agentic-security/scan-history.json +0 -331
  95. package/src/mcp/.agentic-security/streak.json +0 -20
  96. package/src/posture/.agentic-security/dpia.md +0 -26
  97. package/src/posture/.agentic-security/findings.json +0 -77181
  98. package/src/posture/.agentic-security/last-scan.json +0 -77181
  99. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  100. package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
  101. package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
  102. package/src/posture/.agentic-security/sbom-history/0724c133d2943c87555695b5b2adcfcfc3373a2d.json +0 -6
  103. package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  104. package/src/posture/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  105. package/src/posture/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  106. package/src/posture/.agentic-security/scan-history.json +0 -8904
  107. package/src/posture/.agentic-security/streak.json +0 -21
  108. package/src/posture/.agentic-security/threat-model.json +0 -2038
  109. package/src/posture/.agentic-security/threat-model.md +0 -73
  110. package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
  111. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
  112. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
  113. package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
  114. package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
  115. package/src/report/.agentic-security/dpia.md +0 -26
  116. package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  117. package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json +0 -6
  118. package/src/report/.agentic-security/threat-model.json +0 -7
  119. package/src/report/.agentic-security/threat-model.md +0 -22
  120. package/src/sast/.agentic-security/dpia.md +0 -26
  121. package/src/sast/.agentic-security/findings.json +0 -6154
  122. package/src/sast/.agentic-security/last-scan.json +0 -6154
  123. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  124. package/src/sast/.agentic-security/pqc-migration-plan.json +0 -65
  125. package/src/sast/.agentic-security/pqc-migration-plan.md +0 -30
  126. package/src/sast/.agentic-security/sbom-history/043a7b401c68f5a298c83d4c42e94f118ff2a89a.json +0 -6
  127. package/src/sast/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  128. package/src/sast/.agentic-security/sbom-history/20d77ad7363a82777d506dedbbb1ecfed52f094a.json +0 -6
  129. package/src/sast/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  130. package/src/sast/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  131. package/src/sast/.agentic-security/sbom-history/3c6b3205f04e26f7654943d465281d00e0fa395e.json +0 -6
  132. package/src/sast/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  133. package/src/sast/.agentic-security/sbom-history/5282502e090013219eb006f7e02d8c983bc29c8e.json +0 -6
  134. package/src/sast/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  135. package/src/sast/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  136. package/src/sast/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  137. package/src/sast/.agentic-security/sbom-history/73514b485d4770f3c5ee57d87338bccd1c61d8b7.json +0 -6
  138. package/src/sast/.agentic-security/sbom-history/96fa584fc3134512237d58aac63d6f3778b0cbcb.json +0 -6
  139. package/src/sast/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  140. package/src/sast/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  141. package/src/sast/.agentic-security/sbom-history/a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3.json +0 -6
  142. package/src/sast/.agentic-security/sbom-history/ac236ec3602cfc8fb133f389ec3687e409084673.json +0 -6
  143. package/src/sast/.agentic-security/sbom-history/b57b3e1292f1f9f0de6c5a34a436e330c78008a3.json +0 -6
  144. package/src/sast/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  145. package/src/sast/.agentic-security/sbom-history/dcbfd4935922dd165093c08a1003c338eed937c5.json +0 -6
  146. package/src/sast/.agentic-security/sbom-history/fa017f725615b0293814344c8ef7dfeb06775ca0.json +0 -6
  147. package/src/sast/.agentic-security/scan-history.json +0 -941
  148. package/src/sast/.agentic-security/streak.json +0 -22
  149. package/src/sast/.agentic-security/threat-model.json +0 -816
  150. package/src/sast/.agentic-security/threat-model.md +0 -91
  151. package/src/sca/.agentic-security/findings.json +0 -7460
  152. package/src/sca/.agentic-security/last-scan.json +0 -7460
  153. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  154. package/src/sca/.agentic-security/scan-history.json +0 -113
  155. package/src/sca/.agentic-security/streak.json +0 -21
@@ -1 +0,0 @@
1
- 39996421280552970646e4a1035a28ab4226d74f4ff8ed29cfeae2fa5c693ec8
@@ -1,65 +0,0 @@
1
- {
2
- "generatedAt": "2026-05-31T14:14:14.017Z",
3
- "summary": {
4
- "total": 1,
5
- "hndlCritical": 0,
6
- "standard": 1,
7
- "filesAffected": 1,
8
- "primitivesNeeded": [
9
- "ML-DSA-65"
10
- ]
11
- },
12
- "milestones": [
13
- {
14
- "id": "M1",
15
- "title": "Inventory & policy",
16
- "target": "90 days",
17
- "owner": "security",
18
- "items": [
19
- "Confirm scanner findings against design docs",
20
- "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
21
- "Establish KMS support for hybrid keys"
22
- ]
23
- },
24
- {
25
- "id": "M2",
26
- "title": "HNDL-critical paths to PQ-hybrid",
27
- "target": "180 days",
28
- "owner": "platform",
29
- "items": []
30
- },
31
- {
32
- "id": "M3",
33
- "title": "Standard signing/KEX migration",
34
- "target": "12 months",
35
- "owner": "platform",
36
- "items": [
37
- {
38
- "finding": "pqc-ed25519:rule-pack-signing.js:187",
39
- "file": "rule-pack-signing.js",
40
- "line": 187,
41
- "replacement": "ML-DSA-65"
42
- }
43
- ]
44
- },
45
- {
46
- "id": "M4",
47
- "title": "Deprecate classical primitives",
48
- "target": "24 months",
49
- "owner": "security",
50
- "items": [
51
- "Remove dual-stack libraries once peers are PQ-capable",
52
- "Rotate root CA / long-lived signing keys to ML-DSA"
53
- ]
54
- }
55
- ],
56
- "perFile": {
57
- "rule-pack-signing.js": {
58
- "count": 1,
59
- "subfamilies": [
60
- "pqc-ed25519"
61
- ],
62
- "hndlCritical": false
63
- }
64
- }
65
- }
@@ -1,30 +0,0 @@
1
- # Post-quantum cryptography migration plan
2
-
3
- Generated 2026-05-31.
4
-
5
- **1** pre-quantum primitive sites across **1** files.
6
- HNDL-critical: **0** | Standard: **1**
7
-
8
- ## Recommended PQ primitives
9
- - ML-DSA-65
10
-
11
- ## M1 — Inventory & policy (target 90 days, owner security)
12
- - Confirm scanner findings against design docs
13
- - Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
14
- - Establish KMS support for hybrid keys
15
-
16
- ## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
17
-
18
- ## M3 — Standard signing/KEX migration (target 12 months, owner platform)
19
- - `rule-pack-signing.js:187` → ML-DSA-65
20
-
21
- ## M4 — Deprecate classical primitives (target 24 months, owner security)
22
- - Remove dual-stack libraries once peers are PQ-capable
23
- - Rotate root CA / long-lived signing keys to ML-DSA
24
-
25
- ## References
26
- - NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
27
- - NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
28
- - CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
29
- - RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
30
- - Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)
@@ -1,6 +0,0 @@
1
- {
2
- "sha": "0724c133d2943c87555695b5b2adcfcfc3373a2d",
3
- "ts": "2026-05-30T17:55:31.746Z",
4
- "componentCount": 0,
5
- "components": []
6
- }
@@ -1,6 +0,0 @@
1
- {
2
- "sha": "7d45b5e03804aac084b4a2b4dc8c6f10107d2005",
3
- "ts": "2026-05-30T05:08:00.812Z",
4
- "componentCount": 0,
5
- "components": []
6
- }
@@ -1,6 +0,0 @@
1
- {
2
- "sha": "99c372cdc33ecc9dde92960b4ffadf7775860e61",
3
- "ts": "2026-05-31T14:14:14.016Z",
4
- "componentCount": 0,
5
- "components": []
6
- }
@@ -1,6 +0,0 @@
1
- {
2
- "sha": "b7ac2dada4a9216ccfe8969fc57f988c83f46975",
3
- "ts": "2026-05-31T05:25:45.025Z",
4
- "componentCount": 0,
5
- "components": []
6
- }