@hoanghainh/komagu 2.6.1 → 2.7.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.7.0](https://github.com/hoanghainh1188/komagu/compare/v2.6.1...v2.7.0) (2026-11-14)
+
+
+### Features
+
+* **assess:** add Path Traversal (CWE-22) and SSRF (CWE-918) LSA support ([#395](https://github.com/hoanghainh1188/komagu/issues/395)) ([#400](https://github.com/hoanghainh1188/komagu/issues/400)) ([018cd02](https://github.com/hoanghainh1188/komagu/commit/018cd021f219acc4e214460366f60edf5ad6333e))
+* **operate:** add a zero-dependency MCP server (komagu mcp --stdio) ([#399](https://github.com/hoanghainh1188/komagu/issues/399)) ([a95a08c](https://github.com/hoanghainh1188/komagu/commit/a95a08c37061b0c7a7dbb6ebb369622ba304034e))
+* **remediate:** add BFLA & Mass Assignment auto-fix strategies ([#392](https://github.com/hoanghainh1188/komagu/issues/392)) ([#396](https://github.com/hoanghainh1188/komagu/issues/396)) ([1620d44](https://github.com/hoanghainh1188/komagu/commit/1620d441086f34c4cad09c7df81e3fbbaab6e261))
+* **remediate:** add Tier 2 AI-assisted multi-line fix with verification gate ([#394](https://github.com/hoanghainh1188/komagu/issues/394)) ([#398](https://github.com/hoanghainh1188/komagu/issues/398)) ([a569378](https://github.com/hoanghainh1188/komagu/commit/a5693780710a21c52a4c7982155ff0acd7dbc044))
+
 ## [2.6.1](https://github.com/hoanghainh1188/komagu/compare/v2.6.0...v2.6.1) (2026-11-11)
 
 

package/README.md

@@ -111,6 +111,7 @@ Komagu operates on a strict **Bring-Your-Own-LLM (BYO-LLM)** and runtime-neutral
 | `komagu devsecops run <target>` | Complete SAST, secret leak (Gitleaks), and SCA scan | `npx @hoanghainh/komagu devsecops run .` |
 | `komagu simulate --scenario <name>` | Executes Breach & Attack Simulation (Times Car, Metabase SQLi, IDC Frontier) | `npx @hoanghainh/komagu simulate --target http://localhost:5001 -o report.md` |
 | `komagu demo --up` | Launches the interactive Member Portal reference app | `npx @hoanghainh/komagu demo --up` |
+| `komagu mcp --stdio` | Serves local analysis tools (scan, audit summary, leak check, inventory, dry-run fix preview) over the Model Context Protocol. Standard library only; stdout is JSON-RPC. | `npx @hoanghainh/komagu mcp --stdio` |
 
 ---
 

package/assess/lsa/knowledge/path-ssrf-patterns.md

@@ -0,0 +1,19 @@
+# Path Traversal (CWE-22) & SSRF (CWE-918) Patterns
+
+## 1. Path Traversal (`path_traversal`, CWE-22)
+
+**What to look for:**
+- File-system read/write/download/include sinks (`open`, `fs.readFile`, `res.sendFile`, `new File`, `Files.readAllBytes`, `file_get_contents`, `File.ReadAllText`, `os.Open`) receiving a filename or subpath from request input (`req.query`, `$_GET`, `@RequestParam`, etc.).
+
+**False-positive checks (do NOT report when present):**
+- The path is canonicalized (`realpath`, `getCanonicalPath`, `Path.GetFullPath`, `filepath.Clean`) **and** verified to start with the intended base directory (`resolved.startsWith(baseDir)`).
+- Only an allow-listed fixed filename or basename without directory traversal (`..`) is accepted, or a lookup maps an opaque ID to a server-side path.
+
+## 2. Server-Side Request Forgery (`ssrf`, CWE-918)
+
+**What to look for:**
+- Outbound HTTP/network clients (`requests.get`, `urllib.request.urlopen`, `fetch`, `axios`, `HttpURLConnection`, `RestTemplate`, `curl_init`, `HttpClient`, `http.Get`) using a URL, host, or webhook target controlled by the caller.
+
+**False-positive checks (do NOT report when present):**
+- The scheme and hostname are validated against an explicit server-side allow-list before the request is sent.
+- DNS resolution is checked to reject loopback (`127.0.0.0/8`, `::1`), link-local/cloud metadata (`169.254.169.254`), and RFC1918 private ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) with redirects disabled or re-validated.

package/assess/lsa/knowledge/severity-and-cwe.md

@@ -36,8 +36,10 @@ See `_shared-rules.md` §4. Severity and confidence are independent: a
 | `sql_injection` | string_concatenation, string_interpolation, format_string, template_placeholder, dynamic_identifier, second_order, stored_procedure_dynamic_sql | CWE-89 | A03:2021 |
 | `sql_injection` | (HQL/JPQL) | CWE-564, CWE-89 | A03:2021 |
 | `nosql_injection` | operator_injection, js_injection | CWE-943 | A03:2021 |
+| `path_traversal` | arbitrary_file_read, arbitrary_file_write | CWE-22 | A01:2021 |
+| `ssrf` | unvalidated_outbound_url, internal_metadata_probe | CWE-918 | A10:2021, API7:2023 |
 
-Finding id prefixes: `BOLA-`, `INJ-`, `BFLA-`, `MASS-`.
+Finding id prefixes: `BOLA-`, `INJ-`, `BFLA-`, `MASS-`, `PATH-`, `SSRF-`.
 
 ## Fingerprint
 

package/assess/lsa/scripts/find_path_ssrf.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""Deterministic Tier 1 pre-scanner for Path Traversal (CWE-22) and SSRF (CWE-918).
+
+Usage: find_path_ssrf.py TARGET [--config audit-config.json] [--out path-ssrf.candidates.json]
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Pattern, Tuple
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from lsa_common import KIT_VERSION, iter_source_files, load_config, write_json  # noqa: E402
+from redaction import redact  # noqa: E402
+
+_PATH_SINKS: Tuple[Tuple[str, Pattern[str]], ...] = (
+    ("fs_read_node", re.compile(r"\b(?:fs\.(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync)|res\.(?:sendFile|download))\s*\(")),
+    ("path_open_py", re.compile(r"\b(?:open|send_file|send_from_directory)\s*\(")),
+    ("file_java", re.compile(r"\b(?:new\s+File|Paths\.get|Files\.(?:readAllBytes|readString|newInputStream|copy))\s*\(")),
+    ("file_php", re.compile(r"\b(?:file_get_contents|fopen|readfile|include_once|require_once|include|require)\s*(?:\(| )")),
+    ("file_dotnet", re.compile(r"\bFile\.(?:ReadAllText|ReadAllBytes|OpenRead|OpenWrite)\s*\(")),
+    ("file_go", re.compile(r"\b(?:os\.(?:Open|ReadFile|Create)|ioutil\.ReadFile)\s*\(")),
+)
+
+_SSRF_SINKS: Tuple[Tuple[str, Pattern[str]], ...] = (
+    ("http_py", re.compile(r"\b(?:requests\.(?:get|post|put|delete|head|request)|urllib\.request\.urlopen|httpx\.(?:get|post|request))\s*\(")),
+    ("http_node", re.compile(r"\b(?:fetch|axios(?:\.(?:get|post|put|request))?|https?\.(?:get|request))\s*\(")),
+    ("http_java", re.compile(r"\b(?:new\s+URL\s*\(|HttpURLConnection|RestTemplate\.(?:getFor|postFor|exchange)|WebClient\.)")),
+    ("http_php", re.compile(r"\b(?:curl_init|file_get_contents)\s*\(")),
+    ("http_dotnet", re.compile(r"\b(?:HttpClient|WebRequest\.Create)\b")),
+    ("http_go", re.compile(r"\bhttp\.(?:Get|Post|NewRequest)\s*\(")),
+)
+
+_REQUEST_INPUT_HINT = re.compile(
+    r"(?:\$_(?:GET|POST|REQUEST)|"
+    r"\breq(?:uest)?\.(?:query|params|body|args|form|GET|POST|URL)|"
+    r"\b(?:getParameter|@RequestParam|@PathVariable|r\.URL\.Query|QueryRow|Request\.QueryString)\b|"
+    r"\b(?:file_?name|file_?path|target_?url|webhook_?url|callback_?url|redirect_?url|endpoint_?url|avatar_?url)\b)",
+    re.IGNORECASE,
+)
+
+_LITERAL_ONLY_CALL = re.compile(
+    r"\(\s*(?:['\"][^'\"]+['\"]\s*(?:,|\))|`https?://[^`$]+`)"
+)
+
+_PATH_SANITIZER_HINT = re.compile(
+    r"(?:\brealpath\b|\bcanonical(?:Path)?\b|\bGetFullPath\b|\bPath\.basename\b|\bos\.path\.basename\b|\bfilepath\.Clean\b|\bstartsWith\s*\()",
+    re.IGNORECASE,
+)
+
+_SSRF_SANITIZER_HINT = re.compile(
+    r"(?:\ballowlist\b|\bwhitelist\b|\ballowed_?hosts?\b|\bis_safe_url\b|\bvalidate_url\b)",
+    re.IGNORECASE,
+)
+
+
+def _has_nearby_input(lines: List[str], idx: int, window: int = 5) -> bool:
+    """True when request-controlled input appears on the sink line or within +-window lines."""
+    start = max(0, idx - window)
+    end = min(len(lines), idx + 2)
+    snippet = "\n".join(lines[start:end])
+    return _REQUEST_INPUT_HINT.search(snippet) is not None
+
+
+def _has_nearby_guard(lines: List[str], idx: int, guard_rx: Pattern[str], window: int = 4) -> bool:
+    """True when a sanitizer/allow-list guard is visible near the sink."""
+    start = max(0, idx - window)
+    end = min(len(lines), idx + 2)
+    return guard_rx.search("\n".join(lines[start:end])) is not None
+
+
+def scan_file_path_ssrf(path: Path, rel: str) -> List[Dict[str, Any]]:
+    """Scan a single source file for Path Traversal (CWE-22) and SSRF (CWE-918) candidates."""
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return []
+
+    lines = text.splitlines()
+    candidates: List[Dict[str, Any]] = []
+
+    for idx, line in enumerate(lines):
+        stripped = line.strip()
+        if not stripped or stripped.startswith(("//", "#", "/*", "*")):
+            continue
+        if _LITERAL_ONLY_CALL.search(stripped):
+            continue
+
+        # Check SSRF first when PHP file_get_contents is used with URL hints
+        matched_ssrf = False
+        for sink_id, rx in _SSRF_SINKS:
+            if rx.search(stripped):
+                if sink_id == "http_php" and "file_get_contents" in stripped and not re.search(r"url|http", stripped, re.IGNORECASE):
+                    continue
+                if _has_nearby_input(lines, idx) and not _has_nearby_guard(lines, idx, _SSRF_SANITIZER_HINT):
+                    candidates.append(
+                        {
+                            "category": "ssrf",
+                            "cwe": "CWE-918",
+                            "sink": sink_id,
+                            "file": rel,
+                            "line": idx + 1,
+                            "snippet": redact(stripped[:240]),
+                            "priority": "high",
+                        }
+                    )
+                    matched_ssrf = True
+                break
+
+        if matched_ssrf:
+            continue
+
+        for sink_id, rx in _PATH_SINKS:
+            if rx.search(stripped):
+                if _has_nearby_input(lines, idx) and not _has_nearby_guard(lines, idx, _PATH_SANITIZER_HINT):
+                    candidates.append(
+                        {
+                            "category": "path_traversal",
+                            "cwe": "CWE-22",
+                            "sink": sink_id,
+                            "file": rel,
+                            "line": idx + 1,
+                            "snippet": redact(stripped[:240]),
+                            "priority": "high",
+                        }
+                    )
+                break
+
+    return candidates
+
+
+def find_path_ssrf(target: Path, config: Dict[str, Any], cache: Optional[Any] = None) -> Dict[str, Any]:
+    """Scan target directory for Path Traversal and SSRF candidates."""
+    all_candidates: List[Dict[str, Any]] = []
+    files_scanned = 0
+
+    for path, rel in iter_source_files(target, config):
+        files_scanned += 1
+        found = scan_file_path_ssrf(path, rel)
+        all_candidates.extend(found)
+
+    path_count = sum(1 for c in all_candidates if c["category"] == "path_traversal")
+    ssrf_count = sum(1 for c in all_candidates if c["category"] == "ssrf")
+
+    return {
+        "generated_by": f"lsa find_path_ssrf.py {KIT_VERSION}",
+        "files_scanned": files_scanned,
+        "summary": {
+            "total": len(all_candidates),
+            "path_traversal": path_count,
+            "ssrf": ssrf_count,
+        },
+        "candidates": all_candidates,
+    }
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("target")
+    ap.add_argument("--config")
+    ap.add_argument("--out")
+    a = ap.parse_args()
+    res = find_path_ssrf(Path(a.target).resolve(), load_config(a.config))
+    if a.out:
+        write_json(Path(a.out), res)
+    else:
+        print(f"path_traversal={res['summary']['path_traversal']} ssrf={res['summary']['ssrf']}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/assess/lsa/scripts/findings_to_sarif.py

@@ -50,6 +50,14 @@ RULE_TEXT = {
         "Mass assignment of object properties",
         "A request body is bound to a model or entity without an allow-list, so a caller can write properties they must not control.",
     ),
+    "path_traversal": (
+        "Path traversal / arbitrary file access",
+        "A filesystem path is constructed from request-controlled input without canonicalizing and enforcing a base directory boundary.",
+    ),
+    "ssrf": (
+        "Server-Side Request Forgery (SSRF)",
+        "An outbound network request target URL is derived from request-controlled input without host allow-listing or private-IP blocking.",
+    ),
 }
 
 CWE_TAXONOMY_DEFS: Dict[str, Dict[str, str]] = {
@@ -101,6 +109,18 @@ CWE_TAXONOMY_DEFS: Dict[str, Dict[str, str]] = {
         "shortDescription": "Improper Input Validation",
         "helpUri": "https://cwe.mitre.org/data/definitions/20.html",
     },
+    "CWE-22": {
+        "id": "CWE-22",
+        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+        "shortDescription": "Path Traversal",
+        "helpUri": "https://cwe.mitre.org/data/definitions/22.html",
+    },
+    "CWE-918": {
+        "id": "CWE-918",
+        "name": "Server-Side Request Forgery (SSRF)",
+        "shortDescription": "Server-Side Request Forgery (SSRF)",
+        "helpUri": "https://cwe.mitre.org/data/definitions/918.html",
+    },
 }
 
 OWASP_TAGS = {
@@ -129,6 +149,15 @@ OWASP_TAGS = {
         "OWASP:A01:2021-Broken Access Control",
         "OWASP-API3:2023-BOPLA",
     ],
+    "path_traversal": [
+        "external/owasp/a01-2021-broken-access-control",
+        "OWASP:A01:2021-Broken Access Control",
+    ],
+    "ssrf": [
+        "external/owasp/a10-2021-server-side-request-forgery",
+        "OWASP:A10:2021-Server-Side Request Forgery",
+        "OWASP-API7:2023-SSRF",
+    ],
 }
 
 

package/assess/lsa/scripts/merge_findings.py

@@ -139,7 +139,7 @@ def load_validator(schema_name: str):
 
 
 BASE_CATEGORIES = ("bola", "sql_injection", "nosql_injection")
-EXTRA_CATEGORIES = ("bfla", "mass_assignment")
+EXTRA_CATEGORIES = ("bfla", "mass_assignment", "path_traversal", "ssrf")
 
 
 def count_by_category(active: List[Dict]) -> Dict[str, int]:

package/assess/lsa/scripts/run_prescan.py

@@ -25,6 +25,7 @@ from detect_stack import detect  # noqa: E402
 from changed_files import ChangedFilesError, git_changed_files, select_files  # noqa: E402
 from find_injection import find_injection  # noqa: E402
 from find_mass_assignment import find_mass_assignment  # noqa: E402
+from find_path_ssrf import find_path_ssrf  # noqa: E402
 from lsa_common import KIT_VERSION, deep_merge, load_config, write_json  # noqa: E402
 from make_batches import make_batches  # noqa: E402
 from map_routes import map_routes  # noqa: E402
@@ -91,6 +92,8 @@ def main() -> int:
     write_json(out / "injection.candidates.json", inj)
     mass = find_mass_assignment(target, scan_cfg, cache=cache)
     write_json(out / "mass-assignment.candidates.json", mass)
+    path_ssrf = find_path_ssrf(target, scan_cfg, cache=cache)
+    write_json(out / "path-ssrf.candidates.json", path_ssrf)
 
     if cache.enabled:
         cache.save()
@@ -116,6 +119,7 @@ def main() -> int:
         f"- Route candidates: {routes['summary']['total']} (with id-like params: {routes['summary']['with_id_like_params']})",
         f"- Injection candidates: {inj['summary']['total']} (high priority: {inj['summary']['high_priority']})",
         f"- Mass assignment candidates: {mass['summary']['total']} (high priority: {mass['summary']['high_priority']})",
+        f"- Path traversal / SSRF candidates: {path_ssrf['summary']['total']} (path_traversal: {path_ssrf['summary']['path_traversal']}, ssrf: {path_ssrf['summary']['ssrf']})",
         f"- BFLA route hints: {routes['summary'].get('bfla_hints', 0)}",
         f"- Batches: {len(idx['routes'])} route, {len(idx['injection'])} injection",
         f"- Knowledge files to load: {', '.join(prof['knowledge_files'])}", "",

package/assess/lsa/tests/run_tests.py

@@ -187,6 +187,10 @@ def main() -> int:
     if res_mod.returncode != 0:
         fails.append(f"test_modern_stacks.py failed:\n{res_mod.stdout}\n{res_mod.stderr}")
     print(f"  modern stacks    {'OK' if res_mod.returncode == 0 else 'FAIL'}")
+    res_ps = subprocess.run([sys.executable, str(HERE / "test_path_ssrf.py")], capture_output=True, text=True)
+    if res_ps.returncode != 0:
+        fails.append(f"test_path_ssrf.py failed:\n{res_ps.stdout}\n{res_ps.stderr}")
+    print(f"  path & ssrf      {'OK' if res_ps.returncode == 0 else 'FAIL'}")
     res_perf = subprocess.run([sys.executable, str(HERE / "test_performance.py")], capture_output=True, text=True)
     if res_perf.returncode != 0:
         fails.append(f"test_performance.py failed:\n{res_perf.stdout}\n{res_perf.stderr}")

package/assess/lsa/tests/test_path_ssrf.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""Tests for Path Traversal (CWE-22) and SSRF (CWE-918) LSA support (Issue #395)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+KIT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(KIT / "scripts"))
+
+from find_path_ssrf import find_path_ssrf  # noqa: E402
+from findings_to_sarif import to_sarif  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+
+
+class TestPathTraversalAndSSRF(unittest.TestCase):
+    """Verify Tier 1 pre-scan and SARIF export for path_traversal and ssrf."""
+
+    def setUp(self) -> None:
+        self.temp_dir = Path(tempfile.mkdtemp(prefix="komagu_path_ssrf_")).resolve()
+        self.cfg = load_config(None)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.temp_dir, ignore_errors=True)
+
+    def test_detects_vulnerable_and_skips_sanitized(self) -> None:
+        (self.temp_dir / "files.js").write_text(
+            "const fs = require('fs');\n"
+            "app.get('/download', (req, res) => {\n"
+            "  fs.readFile('/var/data/' + req.query.file, () => {});\n"
+            "});\n"
+            "app.get('/safe-download', (req, res) => {\n"
+            "  const safe = path.basename(req.query.file);\n"
+            "  fs.readFile('/var/data/' + safe, () => {});\n"
+            "});\n",
+            encoding="utf-8",
+        )
+        (self.temp_dir / "webhook.py").write_text(
+            "import requests\n"
+            "def send_webhook(request):\n"
+            "    target_url = request.args.get('url')\n"
+            "    return requests.post(target_url, json={'ok': True})\n"
+            "def health():\n"
+            "    return requests.get('https://status.example.com/ping')\n",
+            encoding="utf-8",
+        )
+
+        res = find_path_ssrf(self.temp_dir, self.cfg)
+        self.assertEqual(res["summary"]["path_traversal"], 1)
+        self.assertEqual(res["summary"]["ssrf"], 1)
+        cats = {c["category"]: c for c in res["candidates"]}
+        self.assertEqual(cats["path_traversal"]["cwe"], "CWE-22")
+        self.assertEqual(cats["path_traversal"]["line"], 3)
+        self.assertEqual(cats["ssrf"]["cwe"], "CWE-918")
+        self.assertEqual(cats["ssrf"]["line"], 4)
+
+    def test_sarif_export_supports_path_traversal_and_ssrf(self) -> None:
+        findings = [
+            {
+                "finding_id": "PATH-01",
+                "category": "path_traversal",
+                "severity": "high",
+                "confidence": "high",
+                "status": "confirmed",
+                "title": "Arbitrary file read via ?file=",
+                "cwe": ["CWE-22"],
+                "location": {"file": "files.js", "start_line": 3},
+            },
+            {
+                "finding_id": "SSRF-01",
+                "category": "ssrf",
+                "severity": "high",
+                "confidence": "high",
+                "status": "confirmed",
+                "title": "Unvalidated webhook URL",
+                "cwe": ["CWE-918"],
+                "location": {"file": "webhook.py", "start_line": 4},
+            },
+        ]
+        sarif = to_sarif({"findings": findings}, target_dir=self.temp_dir)
+        results = sarif["runs"][0]["results"]
+        self.assertEqual(len(results), 2)
+        rule_ids = {r["ruleId"] for r in results}
+        self.assertIn("lsa/path_traversal/general", rule_ids)
+        self.assertIn("lsa/ssrf/general", rule_ids)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/contracts/schemas/finding.schema.json

@@ -19,7 +19,7 @@
   "properties": {
     "finding_id": {
       "type": "string",
-      "pattern": "^(BOLA|INJ|BFLA|MASS)-[A-Za-z0-9_.-]+$"
+      "pattern": "^(BOLA|INJ|BFLA|MASS|PATH|SSRF)-[A-Za-z0-9_.-]+$"
     },
     "category": {
       "enum": [
@@ -27,7 +27,9 @@
         "sql_injection",
         "nosql_injection",
         "bfla",
-        "mass_assignment"
+        "mass_assignment",
+        "path_traversal",
+        "ssrf"
       ]
     },
     "fingerprint": {

package/operate/README.md

@@ -22,7 +22,12 @@ This directory provides CI/CD components for automated security verification, pr
    - `github/cross-user-authz.yml`: Reusable GitHub Actions workflow.
    - `gitlab/cross-user-authz.gitlab-ci.yml`: GitLab CI security template.
 
-4. **Automated Remediation Runner (`remediator/runner.py` / `komagu fix`)**:
+4. **MCP server (`operate/mcp/`, `komagu mcp --stdio`)**:
+   - Speaks the Model Context Protocol on stdin/stdout with the Python standard library only (no MCP SDK).
+   - Tools stay local: Tier 1 `scan`, `read_audit`, `leak_check`, `inventory`, and `fix_preview`.
+   - `fix_preview` is a dry run and does not modify source. Patch apply, the edge gateway, and live cross-user tests stay on the CLI.
+
+5. **Automated Remediation Runner (`remediator/runner.py` / `komagu fix`)**:
    - Parses audit findings (`findings.json` or SARIF) and generates automated code fixes for BOLA/IDOR and SQLi vulnerabilities.
    - Supports dry-run simulation, unified patch export, and direct in-place remediation.
 

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.6.1"  # x-release-please-version
+__version__ = "2.7.0"  # x-release-please-version

package/operate/cli/commands/fix.py

@@ -4,10 +4,14 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 import sys
 from pathlib import Path
 from typing import Any
 
+from operate.ai.client import REASONING_EFFORTS
+from operate.remediator.ai_fixer import AITier2Fixer
+
 from operate.cli.ui import (
     BOLD,
     CYAN,
@@ -89,6 +93,38 @@ Examples:
         default="summary",
         help="Output format: summary table (default), json, or diff",
     )
+    parser.add_argument(
+        "--ai",
+        action="store_true",
+        help="Enable Tier 2 AI-assisted multi-line fix fallback with verification gate when deterministic patchers cannot rewrite a finding",
+    )
+    parser.add_argument(
+        "--ai-endpoint",
+        default=os.environ.get("KOMAGU_AI_ENDPOINT", "http://localhost:11434/v1"),
+        help="OpenAI-compatible /v1 endpoint for --ai fixes (default: $KOMAGU_AI_ENDPOINT or http://localhost:11434/v1)",
+    )
+    parser.add_argument(
+        "--ai-model",
+        default=os.environ.get("KOMAGU_AI_MODEL", "llama3.1"),
+        help="Model name for --ai fixes (default: $KOMAGU_AI_MODEL or llama3.1)",
+    )
+    parser.add_argument(
+        "--ai-api-key",
+        default=os.environ.get("KOMAGU_AI_API_KEY") or os.environ.get("OPENAI_API_KEY"),
+        help="API key for --ai endpoint (default: $KOMAGU_AI_API_KEY or $OPENAI_API_KEY)",
+    )
+    parser.add_argument(
+        "--ai-timeout",
+        type=int,
+        default=120,
+        help="Timeout in seconds per --ai LLM request (default: 120)",
+    )
+    parser.add_argument(
+        "--ai-reasoning-effort",
+        choices=REASONING_EFFORTS,
+        default=None,
+        help="Reasoning effort passed to OpenAI-compatible endpoint (default: not sent)",
+    )
     parser.set_defaults(func=run_fix)
 
 
@@ -100,6 +136,16 @@ def run_fix(args: argparse.Namespace) -> int:
         step_fail(f"Target path does not exist: {target_path}")
         return 1
 
+    ai_fixer = None
+    if getattr(args, "ai", False):
+        ai_fixer = AITier2Fixer(
+            endpoint=args.ai_endpoint,
+            model=args.ai_model,
+            api_key=args.ai_api_key,
+            timeout=args.ai_timeout,
+            reasoning_effort=args.ai_reasoning_effort,
+        )
+
     runner = RemediationRunner(
         target_dir=target_path,
         findings_path=args.findings_path,
@@ -107,6 +153,7 @@ def run_fix(args: argparse.Namespace) -> int:
         output_patch=args.output_patch,
         scan_sca=getattr(args, "sca", False),
         query_osv=getattr(args, "osv", False),
+        ai_fixer=ai_fixer,
     )
 
     mode_label = "DRY-RUN (Simulated)" if args.dry_run else "APPLY (In-place)"

package/operate/cli/commands/mcp.py

@@ -0,0 +1,54 @@
+"""Command: komagu mcp - zero-dependency Model Context Protocol server."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+
+def register_subcommand(subparsers: argparse._SubParsersAction) -> None:
+    """Register the mcp subcommand parser."""
+    parser = subparsers.add_parser(
+        "mcp",
+        help="Serve Komagu analysis tools over the Model Context Protocol on stdio",
+        description=(
+            "Speaks MCP JSON-RPC on stdin and stdout using the Python standard library only. "
+            "Tools are local: Tier 1 scan, audit summary, leak check, API inventory, and a dry-run fix preview. "
+            "The preview never modifies source. Logging is written to stderr so stdout stays a protocol stream."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # Cursor, Claude Code, or any MCP client that launches a stdio server
+  komagu mcp --stdio
+
+Client configuration:
+  {
+    "mcpServers": {
+      "komagu": {
+        "command": "komagu",
+        "args": ["mcp", "--stdio"]
+      }
+    }
+  }
+""",
+    )
+    parser.add_argument(
+        "--stdio",
+        action="store_true",
+        help="Speak newline-delimited MCP JSON-RPC on stdin/stdout (the only transport)",
+    )
+    parser.set_defaults(func=run_mcp)
+
+
+def run_mcp(args: argparse.Namespace) -> int:
+    """Start the stdio server, or reject the command when --stdio was omitted."""
+    if not getattr(args, "stdio", False):
+        print(
+            "komagu mcp: the only transport is stdio. Run: komagu mcp --stdio",
+            file=sys.stderr,
+        )
+        return 2
+    from operate.mcp.server import serve_stdio
+
+    return serve_stdio()