@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (128) hide show
  1. package/CHANGELOG.md +660 -0
  2. package/bin/agentic-security.js +78 -1
  3. package/dist/178.index.js +1 -1
  4. package/dist/384.index.js +1 -1
  5. package/dist/415.index.js +90 -0
  6. package/dist/444.index.js +89 -0
  7. package/dist/503.index.js +288 -0
  8. package/dist/637.index.js +15 -1
  9. package/dist/838.index.js +1 -1
  10. package/dist/985.index.js +5 -1
  11. package/dist/agentic-security.mjs +84 -84
  12. package/dist/agentic-security.mjs.sha256 +1 -1
  13. package/package.json +21 -10
  14. package/src/dataflow/CLAUDE.md +18 -6
  15. package/src/dataflow/catalog.js +59 -11
  16. package/src/dataflow/engine.js +106 -5
  17. package/src/dataflow/implicit-flow.js +4 -2
  18. package/src/dataflow/index.js +17 -4
  19. package/src/dataflow/proof-gate.js +100 -0
  20. package/src/dataflow/summaries.js +63 -6
  21. package/src/engine.js +292 -10
  22. package/src/ir/CLAUDE.md +1 -0
  23. package/src/ir/callgraph.js +12 -1
  24. package/src/ir/parser-go.js +8 -0
  25. package/src/ir/tree-sitter-loader.js +108 -0
  26. package/src/mcp/tools.js +6 -2
  27. package/src/posture/corpus-status.js +74 -0
  28. package/src/posture/coverage-report.js +113 -0
  29. package/src/posture/fix-history.js +24 -0
  30. package/src/posture/holdout-eval.js +57 -0
  31. package/src/posture/provenance.js +39 -0
  32. package/src/posture/router.js +33 -3
  33. package/src/posture/sca-verdict.js +130 -0
  34. package/src/posture/secret-history.js +72 -0
  35. package/src/pr-delta.js +13 -0
  36. package/src/report/index.js +67 -0
  37. package/src/sast/CLAUDE.md +9 -3
  38. package/src/sast/agent-untrusted-flow.js +107 -0
  39. package/src/sast/api-authz.js +71 -0
  40. package/src/sast/code-injection-multilang.js +117 -0
  41. package/src/sast/cross-service.js +98 -0
  42. package/src/sast/crypto-protocol.js +43 -1
  43. package/src/sast/csharp-structural.js +65 -0
  44. package/src/sast/csharp.js +3 -0
  45. package/src/sast/csrf.js +24 -3
  46. package/src/sast/csv-injection.js +84 -0
  47. package/src/sast/event-entrypoint.js +90 -0
  48. package/src/sast/frontend-hygiene.js +106 -0
  49. package/src/sast/go-structural.js +60 -0
  50. package/src/sast/iac-terraform.js +107 -0
  51. package/src/sast/java-structural.js +81 -0
  52. package/src/sast/js-framework-structural.js +115 -0
  53. package/src/sast/kotlin.js +72 -0
  54. package/src/sast/ldap-injection.js +73 -17
  55. package/src/sast/open-redirect.js +47 -5
  56. package/src/sast/php.js +35 -0
  57. package/src/sast/python-structural.js +83 -0
  58. package/src/sast/rbac-consistency.js +113 -0
  59. package/src/sast/redos-nfa.js +75 -0
  60. package/src/sast/response-splitting.js +48 -19
  61. package/src/sast/ruby.js +38 -0
  62. package/src/sast/secret-concat.js +60 -0
  63. package/src/sast/ssrf-cloud-metadata.js +13 -0
  64. package/src/sast/stored-taint.js +88 -0
  65. package/src/sast/tree-sitter-sinks.js +62 -0
  66. package/src/sast/weak-password-hash.js +28 -0
  67. package/src/sast/weak-randomness.js +46 -5
  68. package/src/sast/wrong-context-sanitizer.js +149 -0
  69. package/src/sast/xpath-injection.js +30 -6
  70. package/src/sast/xss-reflected-multilang.js +116 -0
  71. package/src/sast/xxe.js +67 -0
  72. package/src/sca/image-packages.js +74 -0
  73. package/src/sca/import-reachability.js +271 -0
  74. package/src/sca/install-script-analysis.js +82 -0
  75. package/bin/.agentic-security/findings.json +0 -1907
  76. package/bin/.agentic-security/last-scan.json +0 -1907
  77. package/bin/.agentic-security/last-scan.json.sig +0 -1
  78. package/bin/.agentic-security/scan-history.json +0 -166
  79. package/bin/.agentic-security/streak.json +0 -20
  80. package/src/.agentic-security/findings.json +0 -117732
  81. package/src/.agentic-security/last-scan.json +0 -117732
  82. package/src/.agentic-security/last-scan.json.sig +0 -1
  83. package/src/.agentic-security/scan-history.json +0 -12946
  84. package/src/.agentic-security/streak.json +0 -21
  85. package/src/dataflow/.agentic-security/findings.json +0 -6086
  86. package/src/dataflow/.agentic-security/last-scan.json +0 -6086
  87. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  88. package/src/dataflow/.agentic-security/scan-history.json +0 -250
  89. package/src/dataflow/.agentic-security/streak.json +0 -21
  90. package/src/ir/.agentic-security/findings.json +0 -4011
  91. package/src/ir/.agentic-security/last-scan.json +0 -4011
  92. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  93. package/src/ir/.agentic-security/scan-history.json +0 -193
  94. package/src/ir/.agentic-security/streak.json +0 -20
  95. package/src/mcp/.agentic-security/findings.json +0 -8632
  96. package/src/mcp/.agentic-security/last-scan.json +0 -8632
  97. package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
  98. package/src/mcp/.agentic-security/scan-history.json +0 -331
  99. package/src/mcp/.agentic-security/streak.json +0 -20
  100. package/src/posture/.agentic-security/dpia.md +0 -26
  101. package/src/posture/.agentic-security/findings.json +0 -77181
  102. package/src/posture/.agentic-security/last-scan.json +0 -77181
  103. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  104. package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
  105. package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
  106. package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  107. package/src/posture/.agentic-security/scan-history.json +0 -8904
  108. package/src/posture/.agentic-security/streak.json +0 -21
  109. package/src/posture/.agentic-security/threat-model.json +0 -2038
  110. package/src/posture/.agentic-security/threat-model.md +0 -73
  111. package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
  112. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
  113. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
  114. package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
  115. package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
  116. package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  117. package/src/report/.agentic-security/threat-model.json +0 -7
  118. package/src/report/.agentic-security/threat-model.md +0 -22
  119. package/src/sast/.agentic-security/findings.json +0 -6154
  120. package/src/sast/.agentic-security/last-scan.json +0 -6154
  121. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  122. package/src/sast/.agentic-security/scan-history.json +0 -941
  123. package/src/sast/.agentic-security/streak.json +0 -22
  124. package/src/sca/.agentic-security/findings.json +0 -7460
  125. package/src/sca/.agentic-security/last-scan.json +0 -7460
  126. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  127. package/src/sca/.agentic-security/scan-history.json +0 -113
  128. package/src/sca/.agentic-security/streak.json +0 -21
package/src/mcp/.agentic-security/last-scan.json.sig DELETED
@@ -1 +0,0 @@
1
- 7bb61d3bece7b47b3d112df139e09a5a95a0c51828999fa1734804ee3f7b6efc
package/src/mcp/.agentic-security/scan-history.json DELETED
@@ -1,331 +0,0 @@
1
- [
2
- {
3
- "timestamp": "2026-05-28T17:48:43.152Z",
4
- "label": "scan",
5
- "total": 35,
6
- "critical": 0,
7
- "high": 0,
8
- "medium": 35,
9
- "low": 0,
10
- "kev": 0,
11
- "ids": [
12
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
13
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
14
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
15
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
16
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
17
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
18
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
19
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
20
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
21
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
22
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
23
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
24
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
25
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
26
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
27
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
28
- "struct:tools.js:279:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
29
- "struct:tools.js:318:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
30
- "struct:tools.js:326:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
31
- "struct:tools.js:533:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
32
- "struct:tools.js:669:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
33
- "struct:tools.js:744:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
34
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
35
- "struct:tools.js:751:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
36
- "struct:tools.js:754:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
37
- "struct:tools.js:833:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
38
- "struct:tools.js:842:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
39
- "struct:tools.js:871:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
40
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
41
- "toctou-fs:audit.js:127",
42
- "toctou-fs:audit.js:52",
43
- "toctou-fs:tools.js:196",
44
- "toctou-fs:tools.js:318",
45
- "toctou-fs:tools.js:751",
46
- "toctou-fs:tools.js:833"
47
- ]
48
- },
49
- {
50
- "timestamp": "2026-05-28T18:12:31.102Z",
51
- "label": "scan",
52
- "total": 35,
53
- "critical": 0,
54
- "high": 0,
55
- "medium": 35,
56
- "low": 0,
57
- "kev": 0,
58
- "ids": [
59
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
60
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
61
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
62
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
63
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
64
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
65
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
66
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
67
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
68
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
69
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
70
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
71
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
72
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
73
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
74
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
75
- "struct:tools.js:279:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
76
- "struct:tools.js:318:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
77
- "struct:tools.js:326:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
78
- "struct:tools.js:533:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
79
- "struct:tools.js:669:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
80
- "struct:tools.js:744:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
81
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
82
- "struct:tools.js:751:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
83
- "struct:tools.js:754:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
84
- "struct:tools.js:833:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
85
- "struct:tools.js:842:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
86
- "struct:tools.js:871:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
87
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
88
- "toctou-fs:audit.js:127",
89
- "toctou-fs:audit.js:52",
90
- "toctou-fs:tools.js:196",
91
- "toctou-fs:tools.js:318",
92
- "toctou-fs:tools.js:751",
93
- "toctou-fs:tools.js:833"
94
- ]
95
- },
96
- {
97
- "timestamp": "2026-05-28T18:14:00.048Z",
98
- "label": "scan",
99
- "total": 35,
100
- "critical": 0,
101
- "high": 0,
102
- "medium": 35,
103
- "low": 0,
104
- "kev": 0,
105
- "ids": [
106
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
107
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
108
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
109
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
110
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
111
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
112
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
113
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
114
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
115
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
116
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
117
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
118
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
119
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
120
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
121
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
122
- "struct:tools.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
123
- "struct:tools.js:320:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
124
- "struct:tools.js:328:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
125
- "struct:tools.js:535:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
126
- "struct:tools.js:671:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
127
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
128
- "struct:tools.js:748:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
129
- "struct:tools.js:753:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
130
- "struct:tools.js:756:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
131
- "struct:tools.js:835:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
132
- "struct:tools.js:844:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
133
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
134
- "struct:tools.js:875:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
135
- "toctou-fs:audit.js:127",
136
- "toctou-fs:audit.js:52",
137
- "toctou-fs:tools.js:196",
138
- "toctou-fs:tools.js:320",
139
- "toctou-fs:tools.js:753",
140
- "toctou-fs:tools.js:835"
141
- ]
142
- },
143
- {
144
- "timestamp": "2026-05-29T20:12:38.328Z",
145
- "label": "scan",
146
- "total": 35,
147
- "critical": 0,
148
- "high": 0,
149
- "medium": 35,
150
- "low": 0,
151
- "kev": 0,
152
- "ids": [
153
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
154
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
155
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
156
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
157
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
158
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
159
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
160
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
161
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
162
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
163
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
164
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
165
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
166
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
167
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
168
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
169
- "struct:tools.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
170
- "struct:tools.js:320:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
171
- "struct:tools.js:328:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
172
- "struct:tools.js:535:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
173
- "struct:tools.js:671:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
174
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
175
- "struct:tools.js:748:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
176
- "struct:tools.js:753:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
177
- "struct:tools.js:756:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
178
- "struct:tools.js:835:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
179
- "struct:tools.js:844:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
180
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
181
- "struct:tools.js:875:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
182
- "toctou-fs:audit.js:127",
183
- "toctou-fs:audit.js:52",
184
- "toctou-fs:tools.js:196",
185
- "toctou-fs:tools.js:320",
186
- "toctou-fs:tools.js:753",
187
- "toctou-fs:tools.js:835"
188
- ]
189
- },
190
- {
191
- "timestamp": "2026-05-29T20:12:45.655Z",
192
- "label": "scan",
193
- "total": 35,
194
- "critical": 0,
195
- "high": 0,
196
- "medium": 35,
197
- "low": 0,
198
- "kev": 0,
199
- "ids": [
200
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
201
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
202
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
203
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
204
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
205
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
206
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
207
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
208
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
209
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
210
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
211
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
212
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
213
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
214
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
215
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
216
- "struct:tools.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
217
- "struct:tools.js:320:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
218
- "struct:tools.js:328:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
219
- "struct:tools.js:535:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
220
- "struct:tools.js:671:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
221
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
222
- "struct:tools.js:748:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
223
- "struct:tools.js:753:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
224
- "struct:tools.js:756:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
225
- "struct:tools.js:835:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
226
- "struct:tools.js:844:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
227
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
228
- "struct:tools.js:875:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
229
- "toctou-fs:audit.js:127",
230
- "toctou-fs:audit.js:52",
231
- "toctou-fs:tools.js:196",
232
- "toctou-fs:tools.js:320",
233
- "toctou-fs:tools.js:753",
234
- "toctou-fs:tools.js:835"
235
- ]
236
- },
237
- {
238
- "timestamp": "2026-05-29T20:35:14.131Z",
239
- "label": "scan",
240
- "total": 35,
241
- "critical": 0,
242
- "high": 0,
243
- "medium": 35,
244
- "low": 0,
245
- "kev": 0,
246
- "ids": [
247
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
248
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
249
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
250
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
251
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
252
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
253
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
254
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
255
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
256
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
257
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
258
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
259
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
260
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
261
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
262
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
263
- "struct:tools.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
264
- "struct:tools.js:320:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
265
- "struct:tools.js:328:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
266
- "struct:tools.js:535:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
267
- "struct:tools.js:671:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
268
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
269
- "struct:tools.js:748:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
270
- "struct:tools.js:753:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
271
- "struct:tools.js:756:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
272
- "struct:tools.js:835:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
273
- "struct:tools.js:844:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
274
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
275
- "struct:tools.js:875:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
276
- "toctou-fs:audit.js:127",
277
- "toctou-fs:audit.js:52",
278
- "toctou-fs:tools.js:196",
279
- "toctou-fs:tools.js:320",
280
- "toctou-fs:tools.js:753",
281
- "toctou-fs:tools.js:835"
282
- ]
283
- },
284
- {
285
- "timestamp": "2026-05-29T20:35:23.436Z",
286
- "label": "scan",
287
- "total": 35,
288
- "critical": 0,
289
- "high": 0,
290
- "medium": 35,
291
- "low": 0,
292
- "kev": 0,
293
- "ids": [
294
- "struct:audit.js:102:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
295
- "struct:audit.js:113:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
296
- "struct:audit.js:127:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
297
- "struct:audit.js:128:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
298
- "struct:audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
299
- "struct:audit.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
300
- "struct:audit.js:88:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
301
- "struct:server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
302
- "struct:server.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
303
- "struct:tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
304
- "struct:tools.js:163:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
305
- "struct:tools.js:167:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
306
- "struct:tools.js:196:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
307
- "struct:tools.js:211:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
308
- "struct:tools.js:226:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
309
- "struct:tools.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
310
- "struct:tools.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
311
- "struct:tools.js:320:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
312
- "struct:tools.js:328:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
313
- "struct:tools.js:535:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
314
- "struct:tools.js:671:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
315
- "struct:tools.js:746:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
316
- "struct:tools.js:748:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
317
- "struct:tools.js:753:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
318
- "struct:tools.js:756:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
319
- "struct:tools.js:835:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
320
- "struct:tools.js:844:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
321
- "struct:tools.js:873:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
322
- "struct:tools.js:875:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
323
- "toctou-fs:audit.js:127",
324
- "toctou-fs:audit.js:52",
325
- "toctou-fs:tools.js:196",
326
- "toctou-fs:tools.js:320",
327
- "toctou-fs:tools.js:753",
328
- "toctou-fs:tools.js:835"
329
- ]
330
- }
331
- ]
package/src/mcp/.agentic-security/streak.json DELETED
@@ -1,20 +0,0 @@
1
- {
2
- "firstScanDate": "2026-05-28T17:48:43.176Z",
3
- "lastScanDate": "2026-05-29T20:35:23.458Z",
4
- "totalScans": 7,
5
- "daysCleanCritical": 2,
6
- "lastCleanDate": "2026-05-29",
7
- "lastCriticalDate": null,
8
- "hasEverHadCritical": false,
9
- "bestDaysCleanCritical": 2,
10
- "totalFindingsAtFirstScan": 40,
11
- "totalFindingsAtLastScan": 40,
12
- "totalFixesInferred": 0,
13
- "lastGrade": "A-",
14
- "bestGrade": "A-",
15
- "launchCheckPassedAt": null,
16
- "achievements": [
17
- "first-scan"
18
- ],
19
- "previousGrade": "A-"
20
- }
package/src/posture/.agentic-security/dpia.md DELETED
@@ -1,26 +0,0 @@
1
- # Data Protection Impact Assessment (DPIA)
2
-
3
- Generated by agentic-security scanner on 2026-05-30.
4
-
5
- This is an automated DPIA scaffold derived from static analysis.
6
- It must be reviewed and completed by a privacy officer before use.
7
-
8
- ## Data classes identified
9
-
10
- ## Privacy-related findings
11
-
12
- | Severity | File:Line | Class → Sink | Description |
13
- |---|---|---|---|
14
-
15
- ## Regulatory framework mapping
16
-
17
- - **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
18
- - **CCPA §1798.130** — Notice + access rights for collected personal information.
19
-
20
- ## Reviewer checklist
21
-
22
- - [ ] Confirm each PII field's collection has a documented lawful basis
23
- - [ ] Confirm retention period for each class is documented
24
- - [ ] Confirm DSAR (data subject access request) workflow exists
25
- - [ ] Confirm encryption at rest + in transit for each class
26
- - [ ] Confirm logging of PII access for audit (where applicable)