@clear-capabilities/agentic-security-scanner 0.75.0 → 0.76.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (24) hide show
  1. package/CHANGELOG.md +57 -0
  2. package/bin/.agentic-security/findings.json +3 -3
  3. package/bin/.agentic-security/last-scan.json +3 -3
  4. package/bin/.agentic-security/last-scan.json.sig +1 -1
  5. package/bin/.agentic-security/scan-history.json +16 -11
  6. package/bin/.agentic-security/streak.json +2 -2
  7. package/bin/agentic-security.js +2 -2
  8. package/dist/838.index.js +152 -0
  9. package/dist/985.index.js +1769 -0
  10. package/dist/agentic-security.mjs +1 -1
  11. package/dist/agentic-security.mjs.sha256 +1 -1
  12. package/package.json +2 -2
  13. package/src/mcp/.agentic-security/findings.json +133 -88
  14. package/src/mcp/.agentic-security/last-scan.json +133 -88
  15. package/src/mcp/.agentic-security/last-scan.json.sig +1 -1
  16. package/src/mcp/.agentic-security/scan-history.json +138 -81
  17. package/src/mcp/.agentic-security/streak.json +4 -4
  18. package/src/mcp/tools.js +17 -2
  19. package/src/sca/.agentic-security/findings.json +1096 -0
  20. package/src/sca/.agentic-security/last-scan.json +1096 -0
  21. package/src/sca/.agentic-security/last-scan.json.sig +1 -0
  22. package/src/sca/.agentic-security/scan-history.json +18 -0
  23. package/src/sca/.agentic-security/streak.json +21 -0
  24. package/src/sca/base-images.json +1 -1
package/src/mcp/.agentic-security/last-scan.json.sig CHANGED
@@ -1 +1 @@
1
- ac345bff3df871eaa40a4f27cfd6ba4edfec6a76eae2638630ec37f1d0f1808c
1
+ 5631e63f07a8029565c2084b53ff72e102e06e44a49d89f8a5f9e18b59c0a2cd
package/src/mcp/.agentic-security/scan-history.json CHANGED
@@ -1,85 +1,4 @@
1
1
  [
2
- {
3
- "timestamp": "2026-05-18T21:08:19.904Z",
4
- "label": "scan",
5
- "total": 14,
6
- "critical": 0,
7
- "high": 0,
8
- "medium": 14,
9
- "low": 0,
10
- "kev": 0,
11
- "ids": [
12
- "struct:audit.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
13
- "struct:audit.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
14
- "struct:audit.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
15
- "struct:audit.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
16
- "struct:audit.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
17
- "struct:server.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
18
- "struct:tools.js:140:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
19
- "struct:tools.js:148:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
20
- "struct:tools.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
21
- "struct:tools.js:403:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
22
- "struct:tools.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
23
- "struct:tools.js:83:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
24
- "struct:tools.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
25
- "struct:tools.js:99:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)"
26
- ]
27
- },
28
- {
29
- "timestamp": "2026-05-19T00:08:13.198Z",
30
- "label": "scan",
31
- "total": 14,
32
- "critical": 0,
33
- "high": 0,
34
- "medium": 14,
35
- "low": 0,
36
- "kev": 0,
37
- "ids": [
38
- "struct:audit.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
39
- "struct:audit.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
40
- "struct:audit.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
41
- "struct:audit.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
42
- "struct:audit.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
43
- "struct:server.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
44
- "struct:tools.js:140:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
45
- "struct:tools.js:148:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
46
- "struct:tools.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
47
- "struct:tools.js:404:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
48
- "struct:tools.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
49
- "struct:tools.js:83:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
50
- "struct:tools.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
51
- "struct:tools.js:99:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)"
52
- ]
53
- },
54
- {
55
- "timestamp": "2026-05-19T20:18:42.254Z",
56
- "label": "scan",
57
- "total": 17,
58
- "critical": 0,
59
- "high": 0,
60
- "medium": 17,
61
- "low": 0,
62
- "kev": 0,
63
- "ids": [
64
- "struct:audit.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
65
- "struct:audit.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
66
- "struct:audit.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
67
- "struct:audit.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
68
- "struct:audit.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
69
- "struct:server.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
70
- "struct:tools.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
71
- "struct:tools.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
72
- "struct:tools.js:143:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
73
- "struct:tools.js:144:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
74
- "struct:tools.js:185:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
75
- "struct:tools.js:193:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
76
- "struct:tools.js:334:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
77
- "struct:tools.js:449:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
78
- "toctou-fs:audit.js:34",
79
- "toctou-fs:audit.js:66",
80
- "toctou-fs:tools.js:113"
81
- ]
82
- },
83
2
  {
84
3
  "timestamp": "2026-05-19T20:18:51.483Z",
85
4
  "label": "scan",
@@ -1121,5 +1040,143 @@
1121
1040
  "toctou-fs:tools.js:723",
1122
1041
  "toctou-fs:tools.js:805"
1123
1042
  ]
1043
+ },
1044
+ {
1045
+ "timestamp": "2026-05-24T15:10:27.373Z",
1046
+ "label": "scan",
1047
+ "total": 34,
1048
+ "critical": 0,
1049
+ "high": 0,
1050
+ "medium": 34,
1051
+ "low": 0,
1052
+ "kev": 0,
1053
+ "ids": [
1054
+ "struct:audit.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1055
+ "struct:audit.js:122:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1056
+ "struct:audit.js:123:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1057
+ "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1058
+ "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1059
+ "struct:audit.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1060
+ "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1061
+ "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1062
+ "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1063
+ "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1064
+ "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1065
+ "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1066
+ "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1067
+ "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1068
+ "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1069
+ "struct:tools.js:279:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1070
+ "struct:tools.js:318:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1071
+ "struct:tools.js:326:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1072
+ "struct:tools.js:519:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1073
+ "struct:tools.js:654:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1074
+ "struct:tools.js:729:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1075
+ "struct:tools.js:731:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1076
+ "struct:tools.js:736:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1077
+ "struct:tools.js:739:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1078
+ "struct:tools.js:818:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1079
+ "struct:tools.js:827:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1080
+ "struct:tools.js:856:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1081
+ "struct:tools.js:858:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1082
+ "toctou-fs:audit.js:122",
1083
+ "toctou-fs:audit.js:52",
1084
+ "toctou-fs:tools.js:196",
1085
+ "toctou-fs:tools.js:318",
1086
+ "toctou-fs:tools.js:736",
1087
+ "toctou-fs:tools.js:818"
1088
+ ]
1089
+ },
1090
+ {
1091
+ "timestamp": "2026-05-24T15:10:37.152Z",
1092
+ "label": "scan",
1093
+ "total": 34,
1094
+ "critical": 0,
1095
+ "high": 0,
1096
+ "medium": 34,
1097
+ "low": 0,
1098
+ "kev": 0,
1099
+ "ids": [
1100
+ "struct:audit.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1101
+ "struct:audit.js:122:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1102
+ "struct:audit.js:123:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1103
+ "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1104
+ "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1105
+ "struct:audit.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1106
+ "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1107
+ "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1108
+ "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1109
+ "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1110
+ "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1111
+ "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1112
+ "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1113
+ "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1114
+ "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1115
+ "struct:tools.js:279:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1116
+ "struct:tools.js:318:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1117
+ "struct:tools.js:326:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1118
+ "struct:tools.js:520:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1119
+ "struct:tools.js:655:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1120
+ "struct:tools.js:730:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1121
+ "struct:tools.js:732:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1122
+ "struct:tools.js:737:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1123
+ "struct:tools.js:740:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1124
+ "struct:tools.js:819:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1125
+ "struct:tools.js:828:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1126
+ "struct:tools.js:857:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1127
+ "struct:tools.js:859:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1128
+ "toctou-fs:audit.js:122",
1129
+ "toctou-fs:audit.js:52",
1130
+ "toctou-fs:tools.js:196",
1131
+ "toctou-fs:tools.js:318",
1132
+ "toctou-fs:tools.js:737",
1133
+ "toctou-fs:tools.js:819"
1134
+ ]
1135
+ },
1136
+ {
1137
+ "timestamp": "2026-05-24T15:10:46.492Z",
1138
+ "label": "scan",
1139
+ "total": 34,
1140
+ "critical": 0,
1141
+ "high": 0,
1142
+ "medium": 34,
1143
+ "low": 0,
1144
+ "kev": 0,
1145
+ "ids": [
1146
+ "struct:audit.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1147
+ "struct:audit.js:122:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1148
+ "struct:audit.js:123:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1149
+ "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1150
+ "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1151
+ "struct:audit.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1152
+ "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1153
+ "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1154
+ "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1155
+ "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1156
+ "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1157
+ "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1158
+ "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1159
+ "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1160
+ "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1161
+ "struct:tools.js:279:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1162
+ "struct:tools.js:318:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1163
+ "struct:tools.js:326:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1164
+ "struct:tools.js:520:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1165
+ "struct:tools.js:656:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1166
+ "struct:tools.js:731:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1167
+ "struct:tools.js:733:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1168
+ "struct:tools.js:738:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1169
+ "struct:tools.js:741:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1170
+ "struct:tools.js:820:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1171
+ "struct:tools.js:829:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1172
+ "struct:tools.js:858:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1173
+ "struct:tools.js:860:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
1174
+ "toctou-fs:audit.js:122",
1175
+ "toctou-fs:audit.js:52",
1176
+ "toctou-fs:tools.js:196",
1177
+ "toctou-fs:tools.js:318",
1178
+ "toctou-fs:tools.js:738",
1179
+ "toctou-fs:tools.js:820"
1180
+ ]
1124
1181
  }
1125
1182
  ]
package/src/mcp/.agentic-security/streak.json CHANGED
@@ -1,9 +1,9 @@
1
1
  {
2
2
  "firstScanDate": "2026-05-18T16:19:09.478Z",
3
- "lastScanDate": "2026-05-19T23:06:35.158Z",
4
- "totalScans": 48,
5
- "daysCleanCritical": 2,
6
- "lastCleanDate": "2026-05-19",
3
+ "lastScanDate": "2026-05-24T15:10:46.517Z",
4
+ "totalScans": 51,
5
+ "daysCleanCritical": 1,
6
+ "lastCleanDate": "2026-05-24",
7
7
  "lastCriticalDate": null,
8
8
  "hasEverHadCritical": false,
9
9
  "bestDaysCleanCritical": 2,
package/src/mcp/tools.js CHANGED
@@ -16,11 +16,24 @@ import * as fs from 'node:fs';
16
16
  import * as fsp from 'node:fs/promises';
17
17
  import * as path from 'node:path';
18
18
  import * as crypto from 'node:crypto';
19
- import { runScan } from '../runScan.js';
20
19
  import { applyFix as applyFixHistory } from '../posture/fix-history.js';
21
20
  import { verifyLastScan } from '../posture/integrity.js';
22
21
  import { redactString, redactFinding } from './redact.js';
23
- import { verifyFix as verifyFixCore } from '../posture/fix-verify.js';
22
+
23
+ // Lazy-loaded: these transitively pull in npm packages (fast-glob,
24
+ // @babel/core) that aren't available in the plugin-cache install path
25
+ // (no node_modules). Deferring keeps the MCP server bootable everywhere;
26
+ // the import only runs when a tool that needs them is actually called.
27
+ let _runScan;
28
+ async function getRunScan() {
29
+ if (!_runScan) _runScan = (await import('../runScan.js')).runScan;
30
+ return _runScan;
31
+ }
32
+ let _verifyFixCore;
33
+ async function getVerifyFixCore() {
34
+ if (!_verifyFixCore) _verifyFixCore = (await import('../posture/fix-verify.js')).verifyFix;
35
+ return _verifyFixCore;
36
+ }
24
37
 
25
38
  const MAX_FILES_PER_SCAN = 1024;
26
39
  const MAX_FILE_BYTES = 500_000;
@@ -315,6 +328,7 @@ export const scan_diff = {
315
328
  fileContents[rel] = content;
316
329
  }
317
330
 
331
+ const runScan = await getRunScan();
318
332
  const result = await runScan(sessionRoot, { network: false, fileContents });
319
333
  const wantSet = new Set(Object.keys(fileContents));
320
334
  const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
@@ -588,6 +602,7 @@ export const verify_fix = {
588
602
  confined[relPath] = String(content);
589
603
  }
590
604
  try {
605
+ const verifyFixCore = await getVerifyFixCore();
591
606
  const r = await verifyFixCore({
592
607
  scanRoot: ctx.sessionRoot,
593
608
  originalFindingStableId: stable_id,