@paretools/security 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dave London
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { registerAllTools } from "./tools/index.js";
+const server = new McpServer({ name: "@paretools/security", version: "0.1.0" }, {
+    instructions: "Structured security scanning operations (trivy, semgrep, gitleaks). Returns typed JSON with vulnerability and finding data. Use instead of running trivy, semgrep, or gitleaks in the terminal.",
+});
+registerAllTools(server);
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD;IACE,YAAY,EACV,iMAAiM;CACpM,CACF,CAAC;AAEF,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAEzB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/lib/formatters.d.ts

@@ -0,0 +1,44 @@
+import type { TrivyScanResult, SemgrepScanResult, GitleaksScanResult } from "../schemas/index.js";
+/** Formats a Trivy scan result into human-readable text. */
+export declare function formatTrivyScan(data: TrivyScanResult): string;
+/** Compact scan result: summary and total only, no individual vulnerabilities. */
+export interface TrivyScanCompact {
+    [key: string]: unknown;
+    target: string;
+    scanType: "image" | "fs" | "config";
+    totalVulnerabilities: number;
+    summary: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        unknown: number;
+    };
+}
+export declare function compactTrivyScanMap(data: TrivyScanResult): TrivyScanCompact;
+export declare function formatTrivyScanCompact(data: TrivyScanCompact): string;
+/** Formats a Semgrep scan result into human-readable text. */
+export declare function formatSemgrepScan(data: SemgrepScanResult): string;
+/** Compact scan result: summary and total only, no individual findings. */
+export interface SemgrepScanCompact {
+    [key: string]: unknown;
+    totalFindings: number;
+    summary: {
+        error: number;
+        warning: number;
+        info: number;
+    };
+    config: string;
+}
+export declare function compactSemgrepScanMap(data: SemgrepScanResult): SemgrepScanCompact;
+export declare function formatSemgrepScanCompact(data: SemgrepScanCompact): string;
+/** Formats a Gitleaks scan result into human-readable text. */
+export declare function formatGitleaksScan(data: GitleaksScanResult): string;
+/** Compact scan result: summary and total only, no individual findings. */
+export interface GitleaksScanCompact {
+    [key: string]: unknown;
+    totalFindings: number;
+}
+export declare function compactGitleaksScanMap(data: GitleaksScanResult): GitleaksScanCompact;
+export declare function formatGitleaksScanCompact(data: GitleaksScanCompact): string;
+//# sourceMappingURL=formatters.d.ts.map

package/dist/lib/formatters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatters.d.ts","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIlG,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAqB7D;AAID,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,CAAC;IACpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAO3E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAID,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAoBjE;AAID,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAMjF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAMzE;AAID,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAgBnE;AAID,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,mBAAmB,CAIpF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAE3E"}

package/dist/lib/formatters.js

@@ -0,0 +1,87 @@
+// -- Full formatters ----------------------------------------------------------
+/** Formats a Trivy scan result into human-readable text. */
+export function formatTrivyScan(data) {
+    const lines = [];
+    lines.push(`Trivy ${data.scanType} scan: ${data.target}`);
+    lines.push(`Found ${data.totalVulnerabilities} vulnerabilities: ` +
+        `${data.summary.critical} critical, ${data.summary.high} high, ` +
+        `${data.summary.medium} medium, ${data.summary.low} low, ` +
+        `${data.summary.unknown} unknown`);
+    if (data.vulnerabilities.length > 0) {
+        lines.push("");
+        for (const v of data.vulnerabilities) {
+            const fixed = v.fixedVersion ? ` -> ${v.fixedVersion}` : "";
+            const title = v.title ? ` - ${v.title}` : "";
+            lines.push(`  [${v.severity}] ${v.id}: ${v.package}@${v.installedVersion}${fixed}${title}`);
+        }
+    }
+    return lines.join("\n");
+}
+export function compactTrivyScanMap(data) {
+    return {
+        target: data.target,
+        scanType: data.scanType,
+        totalVulnerabilities: data.totalVulnerabilities,
+        summary: data.summary,
+    };
+}
+export function formatTrivyScanCompact(data) {
+    return (`Trivy ${data.scanType} scan: ${data.target} -- ` +
+        `${data.totalVulnerabilities} vulnerabilities ` +
+        `(${data.summary.critical}C/${data.summary.high}H/${data.summary.medium}M/${data.summary.low}L)`);
+}
+// -- Semgrep formatters -------------------------------------------------------
+/** Formats a Semgrep scan result into human-readable text. */
+export function formatSemgrepScan(data) {
+    const lines = [];
+    lines.push(`Semgrep scan (config: ${data.config})`);
+    lines.push(`Found ${data.totalFindings} findings: ` +
+        `${data.summary.error} error, ${data.summary.warning} warning, ` +
+        `${data.summary.info} info`);
+    if (data.findings.length > 0) {
+        lines.push("");
+        for (const f of data.findings) {
+            const category = f.category ? ` [${f.category}]` : "";
+            lines.push(`  [${f.severity}] ${f.ruleId}: ${f.path}:${f.startLine}-${f.endLine}${category}`);
+            lines.push(`    ${f.message}`);
+        }
+    }
+    return lines.join("\n");
+}
+export function compactSemgrepScanMap(data) {
+    return {
+        totalFindings: data.totalFindings,
+        summary: data.summary,
+        config: data.config,
+    };
+}
+export function formatSemgrepScanCompact(data) {
+    return (`Semgrep scan (config: ${data.config}) -- ` +
+        `${data.totalFindings} findings ` +
+        `(${data.summary.error}E/${data.summary.warning}W/${data.summary.info}I)`);
+}
+// -- Gitleaks formatters ------------------------------------------------------
+/** Formats a Gitleaks scan result into human-readable text. */
+export function formatGitleaksScan(data) {
+    const lines = [];
+    lines.push(`Gitleaks secret detection scan`);
+    lines.push(`Found ${data.totalFindings} secret(s)`);
+    if (data.findings.length > 0) {
+        lines.push("");
+        for (const f of data.findings) {
+            const commit = f.commit ? ` (commit: ${f.commit.slice(0, 8)})` : "";
+            lines.push(`  [${f.ruleID}] ${f.file}:${f.startLine}-${f.endLine}${commit}`);
+            lines.push(`    ${f.description} -- secret: ${f.secret}`);
+        }
+    }
+    return lines.join("\n");
+}
+export function compactGitleaksScanMap(data) {
+    return {
+        totalFindings: data.totalFindings,
+    };
+}
+export function formatGitleaksScanCompact(data) {
+    return `Gitleaks scan -- ${data.totalFindings} secret(s) detected`;
+}
+//# sourceMappingURL=formatters.js.map

package/dist/lib/formatters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,oBAAoB,oBAAoB;QACpD,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;QAC1D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CACpC,CAAC;IAEF,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAmBD,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,OAAO,CACL,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,MAAM;QACjD,GAAG,IAAI,CAAC,oBAAoB,mBAAmB;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,aAAa,aAAa;QACtC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,YAAY;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAC9B,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC9F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAwB;IAC/D,OAAO,CACL,yBAAyB,IAAI,CAAC,MAAM,OAAO;QAC3C,GAAG,IAAI,CAAC,aAAa,YAAY;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,YAAY,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,OAAO,oBAAoB,IAAI,CAAC,aAAa,qBAAqB,CAAC;AACrE,CAAC"}

package/dist/lib/parsers.d.ts

@@ -0,0 +1,25 @@
+import type { TrivyScanResult, SemgrepScanResult, GitleaksScanResult } from "../schemas/index.js";
+/**
+ * Parses raw Trivy JSON output into a structured TrivyScanResult.
+ *
+ * Trivy's JSON output has a `Results` array, each entry containing
+ * a `Target` and `Vulnerabilities` array. We flatten all vulnerabilities
+ * across all results into a single list.
+ */
+export declare function parseTrivyJson(jsonStr: string, target: string, scanType: "image" | "fs" | "config"): TrivyScanResult;
+/**
+ * Parses raw Semgrep JSON output into a structured SemgrepScanResult.
+ *
+ * Semgrep's JSON output has a `results` array containing findings,
+ * each with check_id, path, start/end positions, and extra metadata.
+ */
+export declare function parseSemgrepJson(jsonStr: string, config: string): SemgrepScanResult;
+/**
+ * Parses raw Gitleaks JSON output into a structured GitleaksScanResult.
+ *
+ * Gitleaks outputs a JSON array of findings. Each finding contains
+ * RuleID, Description, Match, Secret, File, StartLine, EndLine,
+ * Commit, Author, and Date fields.
+ */
+export declare function parseGitleaksJson(jsonStr: string): GitleaksScanResult;
+//# sourceMappingURL=parsers.d.ts.map

package/dist/lib/parsers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAGf,iBAAiB,EAGjB,kBAAkB,EAEnB,MAAM,qBAAqB,CAAC;AAiC7B;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,GAClC,eAAe,CAyDjB;AA4DD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAqCnF;AA2DD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAkCrE"}

package/dist/lib/parsers.js

@@ -0,0 +1,217 @@
+/**
+ * Parses raw Trivy JSON output into a structured TrivyScanResult.
+ *
+ * Trivy's JSON output has a `Results` array, each entry containing
+ * a `Target` and `Vulnerabilities` array. We flatten all vulnerabilities
+ * across all results into a single list.
+ */
+export function parseTrivyJson(jsonStr, target, scanType) {
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonStr);
+    }
+    catch {
+        return {
+            target,
+            scanType,
+            vulnerabilities: [],
+            summary: { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 },
+            totalVulnerabilities: 0,
+        };
+    }
+    const vulnerabilities = [];
+    if (parsed.Results) {
+        for (const result of parsed.Results) {
+            // Handle regular vulnerabilities
+            if (result.Vulnerabilities) {
+                for (const v of result.Vulnerabilities) {
+                    vulnerabilities.push({
+                        id: v.VulnerabilityID || "UNKNOWN",
+                        severity: normalizeSeverity(v.Severity),
+                        package: v.PkgName || "unknown",
+                        installedVersion: v.InstalledVersion || "unknown",
+                        fixedVersion: v.FixedVersion || undefined,
+                        title: v.Title || undefined,
+                    });
+                }
+            }
+            // Handle misconfigurations (config scans)
+            if (result.Misconfigurations) {
+                for (const m of result.Misconfigurations) {
+                    vulnerabilities.push({
+                        id: m.ID || "UNKNOWN",
+                        severity: normalizeSeverity(m.Severity),
+                        package: m.Type || "config",
+                        installedVersion: "N/A",
+                        fixedVersion: undefined,
+                        title: m.Title || m.Message || undefined,
+                    });
+                }
+            }
+        }
+    }
+    const summary = computeSummary(vulnerabilities);
+    return {
+        target,
+        scanType,
+        vulnerabilities,
+        summary,
+        totalVulnerabilities: vulnerabilities.length,
+    };
+}
+/** Normalizes Trivy severity strings to a consistent uppercase form. */
+function normalizeSeverity(severity) {
+    if (!severity)
+        return "UNKNOWN";
+    const upper = severity.toUpperCase();
+    if (["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"].includes(upper))
+        return upper;
+    return upper;
+}
+/** Computes severity summary counts from a list of vulnerabilities. */
+function computeSummary(vulnerabilities) {
+    const summary = { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 };
+    for (const v of vulnerabilities) {
+        switch (v.severity) {
+            case "CRITICAL":
+                summary.critical++;
+                break;
+            case "HIGH":
+                summary.high++;
+                break;
+            case "MEDIUM":
+                summary.medium++;
+                break;
+            case "LOW":
+                summary.low++;
+                break;
+            default:
+                summary.unknown++;
+                break;
+        }
+    }
+    return summary;
+}
+/**
+ * Parses raw Semgrep JSON output into a structured SemgrepScanResult.
+ *
+ * Semgrep's JSON output has a `results` array containing findings,
+ * each with check_id, path, start/end positions, and extra metadata.
+ */
+export function parseSemgrepJson(jsonStr, config) {
+    let parsed;
+    try {
+        parsed = JSON.parse(jsonStr);
+    }
+    catch {
+        return {
+            totalFindings: 0,
+            findings: [],
+            summary: { error: 0, warning: 0, info: 0 },
+            config,
+        };
+    }
+    const findings = [];
+    if (parsed.results) {
+        for (const r of parsed.results) {
+            findings.push({
+                ruleId: r.check_id || "unknown",
+                path: r.path || "unknown",
+                startLine: r.start?.line ?? 0,
+                endLine: r.end?.line ?? 0,
+                message: r.extra?.message || "",
+                severity: normalizeSemgrepSeverity(r.extra?.severity),
+                category: r.extra?.metadata?.category || undefined,
+            });
+        }
+    }
+    const summary = computeSemgrepSummary(findings);
+    return {
+        totalFindings: findings.length,
+        findings,
+        summary,
+        config,
+    };
+}
+/** Normalizes Semgrep severity strings to a consistent uppercase form. */
+function normalizeSemgrepSeverity(severity) {
+    if (!severity)
+        return "INFO";
+    const upper = severity.toUpperCase();
+    if (["ERROR", "WARNING", "INFO"].includes(upper))
+        return upper;
+    return upper;
+}
+/** Computes severity summary counts from a list of Semgrep findings. */
+function computeSemgrepSummary(findings) {
+    const summary = { error: 0, warning: 0, info: 0 };
+    for (const f of findings) {
+        switch (f.severity) {
+            case "ERROR":
+                summary.error++;
+                break;
+            case "WARNING":
+                summary.warning++;
+                break;
+            case "INFO":
+                summary.info++;
+                break;
+            default:
+                // Map unknown severities to info
+                summary.info++;
+                break;
+        }
+    }
+    return summary;
+}
+/**
+ * Redacts a secret string, keeping only the first 3 and last 3 characters
+ * and replacing the rest with asterisks. Secrets 8 chars or shorter are fully
+ * redacted.
+ */
+function redactSecret(secret) {
+    if (secret.length <= 8)
+        return "***";
+    return secret.slice(0, 3) + "***" + secret.slice(-3);
+}
+/**
+ * Parses raw Gitleaks JSON output into a structured GitleaksScanResult.
+ *
+ * Gitleaks outputs a JSON array of findings. Each finding contains
+ * RuleID, Description, Match, Secret, File, StartLine, EndLine,
+ * Commit, Author, and Date fields.
+ */
+export function parseGitleaksJson(jsonStr) {
+    let parsed;
+    try {
+        const raw = JSON.parse(jsonStr);
+        if (!Array.isArray(raw)) {
+            return { totalFindings: 0, findings: [], summary: { totalFindings: 0 } };
+        }
+        parsed = raw;
+    }
+    catch {
+        return { totalFindings: 0, findings: [], summary: { totalFindings: 0 } };
+    }
+    const findings = [];
+    for (const f of parsed) {
+        findings.push({
+            ruleID: f.RuleID || "unknown",
+            description: f.Description || "",
+            match: f.Match || "",
+            secret: redactSecret(f.Secret || ""),
+            file: f.File || "unknown",
+            startLine: f.StartLine ?? 0,
+            endLine: f.EndLine ?? 0,
+            commit: f.Commit || "",
+            author: f.Author || "",
+            date: f.Date || "",
+        });
+    }
+    return {
+        totalFindings: findings.length,
+        findings,
+        summary: { totalFindings: findings.length },
+    };
+}
+//# sourceMappingURL=parsers.js.map

package/dist/lib/parsers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"AA0CA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,MAAc,EACd,QAAmC;IAEnC,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM;YACN,QAAQ;YACR,eAAe,EAAE,EAAE;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;YAChE,oBAAoB,EAAE,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAyB,EAAE,CAAC;IAEjD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,iCAAiC;YACjC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBACvC,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;wBAClC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;wBACjD,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;wBACzC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACzC,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,SAAS;wBACrB,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ;wBAC3B,gBAAgB,EAAE,KAAK;wBACvB,YAAY,EAAE,SAAS;wBACvB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IAEhD,OAAO;QACL,MAAM;QACN,QAAQ;QACR,eAAe;QACf,OAAO;QACP,oBAAoB,EAAE,eAAe,CAAC,MAAM;KAC7C,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB,CAAC,QAA4B;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,eAAqC;IAC3D,MAAM,OAAO,GAAyB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9F,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,UAAU;gBACb,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM;YACR,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM;YACR,KAAK,KAAK;gBACR,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,MAAM;YACR;gBACE,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;YAC1C,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC;gBAC7B,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;gBACzB,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE;gBAC/B,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBACrD,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEhD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,QAA0B;IACvD,MAAM,OAAO,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM;YACR,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR;gBACE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAA4B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;YAC7B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;YACzB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE;KAC5C,CAAC;AACJ,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,124 @@
+import { z } from "zod";
+/** Zod schema for a single vulnerability entry from Trivy output. */
+export declare const TrivyVulnerabilitySchema: z.ZodObject<{
+    id: z.ZodString;
+    severity: z.ZodString;
+    package: z.ZodString;
+    installedVersion: z.ZodString;
+    fixedVersion: z.ZodOptional<z.ZodString>;
+    title: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type TrivyVulnerability = z.infer<typeof TrivyVulnerabilitySchema>;
+/** Zod schema for severity summary counts. */
+export declare const TrivySeveritySummarySchema: z.ZodObject<{
+    critical: z.ZodNumber;
+    high: z.ZodNumber;
+    medium: z.ZodNumber;
+    low: z.ZodNumber;
+    unknown: z.ZodNumber;
+}, z.core.$strip>;
+export type TrivySeveritySummary = z.infer<typeof TrivySeveritySummarySchema>;
+/** Zod schema for the structured Trivy scan result. */
+export declare const TrivyScanResultSchema: z.ZodObject<{
+    target: z.ZodString;
+    scanType: z.ZodEnum<{
+        image: "image";
+        fs: "fs";
+        config: "config";
+    }>;
+    vulnerabilities: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        severity: z.ZodString;
+        package: z.ZodString;
+        installedVersion: z.ZodString;
+        fixedVersion: z.ZodOptional<z.ZodString>;
+        title: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    summary: z.ZodObject<{
+        critical: z.ZodNumber;
+        high: z.ZodNumber;
+        medium: z.ZodNumber;
+        low: z.ZodNumber;
+        unknown: z.ZodNumber;
+    }, z.core.$strip>;
+    totalVulnerabilities: z.ZodNumber;
+}, z.core.$strip>;
+export type TrivyScanResult = z.infer<typeof TrivyScanResultSchema>;
+/** Zod schema for a single Semgrep finding. */
+export declare const SemgrepFindingSchema: z.ZodObject<{
+    ruleId: z.ZodString;
+    path: z.ZodString;
+    startLine: z.ZodNumber;
+    endLine: z.ZodNumber;
+    message: z.ZodString;
+    severity: z.ZodString;
+    category: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SemgrepFinding = z.infer<typeof SemgrepFindingSchema>;
+/** Zod schema for Semgrep severity summary counts. */
+export declare const SemgrepSeveritySummarySchema: z.ZodObject<{
+    error: z.ZodNumber;
+    warning: z.ZodNumber;
+    info: z.ZodNumber;
+}, z.core.$strip>;
+export type SemgrepSeveritySummary = z.infer<typeof SemgrepSeveritySummarySchema>;
+/** Zod schema for the structured Semgrep scan result. */
+export declare const SemgrepScanResultSchema: z.ZodObject<{
+    totalFindings: z.ZodNumber;
+    findings: z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodString;
+        path: z.ZodString;
+        startLine: z.ZodNumber;
+        endLine: z.ZodNumber;
+        message: z.ZodString;
+        severity: z.ZodString;
+        category: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    summary: z.ZodObject<{
+        error: z.ZodNumber;
+        warning: z.ZodNumber;
+        info: z.ZodNumber;
+    }, z.core.$strip>;
+    config: z.ZodString;
+}, z.core.$strip>;
+export type SemgrepScanResult = z.infer<typeof SemgrepScanResultSchema>;
+/** Zod schema for a single Gitleaks finding. */
+export declare const GitleaksFindingSchema: z.ZodObject<{
+    ruleID: z.ZodString;
+    description: z.ZodString;
+    match: z.ZodString;
+    secret: z.ZodString;
+    file: z.ZodString;
+    startLine: z.ZodNumber;
+    endLine: z.ZodNumber;
+    commit: z.ZodString;
+    author: z.ZodString;
+    date: z.ZodString;
+}, z.core.$strip>;
+export type GitleaksFinding = z.infer<typeof GitleaksFindingSchema>;
+/** Zod schema for Gitleaks summary. */
+export declare const GitleaksSummarySchema: z.ZodObject<{
+    totalFindings: z.ZodNumber;
+}, z.core.$strip>;
+export type GitleaksSummary = z.infer<typeof GitleaksSummarySchema>;
+/** Zod schema for the structured Gitleaks scan result. */
+export declare const GitleaksScanResultSchema: z.ZodObject<{
+    totalFindings: z.ZodNumber;
+    findings: z.ZodArray<z.ZodObject<{
+        ruleID: z.ZodString;
+        description: z.ZodString;
+        match: z.ZodString;
+        secret: z.ZodString;
+        file: z.ZodString;
+        startLine: z.ZodNumber;
+        endLine: z.ZodNumber;
+        commit: z.ZodString;
+        author: z.ZodString;
+        date: z.ZodString;
+    }, z.core.$strip>>;
+    summary: z.ZodObject<{
+        totalFindings: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type GitleaksScanResult = z.infer<typeof GitleaksScanResultSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,uDAAuD;AACvD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB;;;;;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sDAAsD;AACtD,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,yDAAyD;AACzD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAKlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE,gDAAgD;AAChD,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAWhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,uCAAuC;AACvC,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,75 @@
+import { z } from "zod";
+/** Zod schema for a single vulnerability entry from Trivy output. */
+export const TrivyVulnerabilitySchema = z.object({
+    id: z.string(),
+    severity: z.string(),
+    package: z.string(),
+    installedVersion: z.string(),
+    fixedVersion: z.string().optional(),
+    title: z.string().optional(),
+});
+/** Zod schema for severity summary counts. */
+export const TrivySeveritySummarySchema = z.object({
+    critical: z.number(),
+    high: z.number(),
+    medium: z.number(),
+    low: z.number(),
+    unknown: z.number(),
+});
+/** Zod schema for the structured Trivy scan result. */
+export const TrivyScanResultSchema = z.object({
+    target: z.string(),
+    scanType: z.enum(["image", "fs", "config"]),
+    vulnerabilities: z.array(TrivyVulnerabilitySchema),
+    summary: TrivySeveritySummarySchema,
+    totalVulnerabilities: z.number(),
+});
+// -- Semgrep schemas ----------------------------------------------------------
+/** Zod schema for a single Semgrep finding. */
+export const SemgrepFindingSchema = z.object({
+    ruleId: z.string(),
+    path: z.string(),
+    startLine: z.number(),
+    endLine: z.number(),
+    message: z.string(),
+    severity: z.string(),
+    category: z.string().optional(),
+});
+/** Zod schema for Semgrep severity summary counts. */
+export const SemgrepSeveritySummarySchema = z.object({
+    error: z.number(),
+    warning: z.number(),
+    info: z.number(),
+});
+/** Zod schema for the structured Semgrep scan result. */
+export const SemgrepScanResultSchema = z.object({
+    totalFindings: z.number(),
+    findings: z.array(SemgrepFindingSchema),
+    summary: SemgrepSeveritySummarySchema,
+    config: z.string(),
+});
+// -- Gitleaks schemas ---------------------------------------------------------
+/** Zod schema for a single Gitleaks finding. */
+export const GitleaksFindingSchema = z.object({
+    ruleID: z.string(),
+    description: z.string(),
+    match: z.string(),
+    secret: z.string(),
+    file: z.string(),
+    startLine: z.number(),
+    endLine: z.number(),
+    commit: z.string(),
+    author: z.string(),
+    date: z.string(),
+});
+/** Zod schema for Gitleaks summary. */
+export const GitleaksSummarySchema = z.object({
+    totalFindings: z.number(),
+});
+/** Zod schema for the structured Gitleaks scan result. */
+export const GitleaksScanResultSchema = z.object({
+    totalFindings: z.number(),
+    findings: z.array(GitleaksFindingSchema),
+    summary: GitleaksSummarySchema,
+});
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAClD,OAAO,EAAE,0BAA0B;IACnC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;CACjC,CAAC,CAAC;AAIH,gFAAgF;AAEhF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACvC,OAAO,EAAE,4BAA4B;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,gFAAgF;AAEhF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,uCAAuC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAIH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACxC,OAAO,EAAE,qBAAqB;CAC/B,CAAC,CAAC"}

package/dist/tools/gitleaks.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerGitleaksTool(server: McpServer): void;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/tools/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,QAkErD"}

package/dist/tools/gitleaks.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
+import { parseGitleaksJson } from "../lib/parsers.js";
+import { formatGitleaksScan, compactGitleaksScanMap, formatGitleaksScanCompact, } from "../lib/formatters.js";
+import { GitleaksScanResultSchema } from "../schemas/index.js";
+export function registerGitleaksTool(server) {
+    server.registerTool("gitleaks", {
+        title: "Gitleaks Secret Detection",
+        description: "Runs Gitleaks to detect hardcoded secrets in git repositories. Returns structured finding data with redacted secrets. Use instead of running `gitleaks` in the terminal.",
+        inputSchema: {
+            path: z
+                .string()
+                .max(INPUT_LIMITS.PATH_MAX)
+                .optional()
+                .describe("Repository path to scan (default: cwd)"),
+            noGit: z
+                .boolean()
+                .optional()
+                .default(false)
+                .describe("Scan files without git history (--no-git). Useful for scanning non-git directories."),
+            verbose: z
+                .boolean()
+                .optional()
+                .default(false)
+                .describe("Enable verbose output from gitleaks"),
+            compact: z
+                .boolean()
+                .optional()
+                .default(true)
+                .describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
+        },
+        outputSchema: GitleaksScanResultSchema,
+    }, async ({ path, noGit, verbose, compact }) => {
+        const cwd = path || process.cwd();
+        const args = ["detect", "--report-format", "json", "--report-path", "/dev/stdout"];
+        if (noGit) {
+            args.push("--no-git");
+        }
+        if (verbose) {
+            args.push("--verbose");
+        }
+        args.push("--source", cwd);
+        // gitleaks exits with code 1 when findings are detected, which is not an error
+        const result = await run("gitleaks", args, { cwd, timeout: 300_000 });
+        const data = parseGitleaksJson(result.stdout);
+        const rawOutput = (result.stdout + "\n" + result.stderr).trim();
+        return compactDualOutput(data, rawOutput, formatGitleaksScan, compactGitleaksScanMap, formatGitleaksScanCompact, compact === false);
+    });
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/tools/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,0KAA0K;QAC5K,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,wCAAwC,CAAC;YACrD,KAAK,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CACP,qFAAqF,CACtF;YACH,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,qCAAqC,CAAC;YAClD,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,wBAAwB;KACvC,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAElC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3B,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerAllTools(server: McpServer): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,QAKjD"}

package/dist/tools/index.js

@@ -0,0 +1,14 @@
+import { shouldRegisterTool } from "@paretools/shared";
+import { registerTrivyTool } from "./trivy.js";
+import { registerSemgrepTool } from "./semgrep.js";
+import { registerGitleaksTool } from "./gitleaks.js";
+export function registerAllTools(server) {
+    const s = (name) => shouldRegisterTool("security", name);
+    if (s("trivy"))
+        registerTrivyTool(server);
+    if (s("semgrep"))
+        registerSemgrepTool(server);
+    if (s("gitleaks"))
+        registerGitleaksTool(server);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,OAAO,CAAC;QAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,SAAS,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC;QAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/tools/semgrep.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerSemgrepTool(server: McpServer): void;
+//# sourceMappingURL=semgrep.d.ts.map

package/dist/tools/semgrep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUzE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA0EpD"}

package/dist/tools/semgrep.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
+import { parseSemgrepJson } from "../lib/parsers.js";
+import { formatSemgrepScan, compactSemgrepScanMap, formatSemgrepScanCompact, } from "../lib/formatters.js";
+import { SemgrepScanResultSchema } from "../schemas/index.js";
+export function registerSemgrepTool(server) {
+    server.registerTool("semgrep", {
+        title: "Semgrep Static Analysis",
+        description: "Runs Semgrep static analysis with structured rules and findings. Returns structured finding data with severity summary. Use instead of running `semgrep` in the terminal.",
+        inputSchema: {
+            patterns: z
+                .array(z.string().max(INPUT_LIMITS.PATH_MAX))
+                .max(INPUT_LIMITS.ARRAY_MAX)
+                .optional()
+                .default(["."])
+                .describe("File patterns or paths to scan (default: ['.'])"),
+            config: z
+                .string()
+                .max(INPUT_LIMITS.SHORT_STRING_MAX)
+                .optional()
+                .default("auto")
+                .describe('Semgrep config/ruleset (e.g. "auto", "p/security-audit", "p/owasp-top-ten"). Default: "auto"'),
+            severity: z
+                .string()
+                .max(INPUT_LIMITS.SHORT_STRING_MAX)
+                .optional()
+                .describe("Comma-separated severity filter (e.g. 'ERROR,WARNING'). Default: all severities"),
+            path: z
+                .string()
+                .max(INPUT_LIMITS.PATH_MAX)
+                .optional()
+                .describe("Working directory (default: cwd)"),
+            compact: z
+                .boolean()
+                .optional()
+                .default(true)
+                .describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
+        },
+        outputSchema: SemgrepScanResultSchema,
+    }, async ({ patterns, config, severity, path, compact }) => {
+        const cwd = path || process.cwd();
+        const args = ["scan", "--json", "--quiet"];
+        if (config) {
+            args.push("--config", config);
+        }
+        if (severity) {
+            args.push("--severity", severity);
+        }
+        args.push(...patterns);
+        const result = await run("semgrep", args, { cwd, timeout: 300_000 });
+        const data = parseSemgrepJson(result.stdout, config);
+        const rawOutput = (result.stdout + "\n" + result.stderr).trim();
+        return compactDualOutput(data, rawOutput, formatSemgrepScan, compactSemgrepScanMap, formatSemgrepScanCompact, compact === false);
+    });
+}
+//# sourceMappingURL=semgrep.js.map

package/dist/tools/semgrep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;iBACd,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CACP,8FAA8F,CAC/F;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,iFAAiF,CAClF;YACH,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,uBAAuB;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAElC,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/trivy.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerTrivyTool(server: McpServer): void;
+//# sourceMappingURL=trivy.d.ts.map

package/dist/tools/trivy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA4ElD"}

package/dist/tools/trivy.js

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
+import { parseTrivyJson } from "../lib/parsers.js";
+import { formatTrivyScan, compactTrivyScanMap, formatTrivyScanCompact } from "../lib/formatters.js";
+import { TrivyScanResultSchema } from "../schemas/index.js";
+export function registerTrivyTool(server) {
+    server.registerTool("trivy", {
+        title: "Trivy Security Scanner",
+        description: "Runs Trivy vulnerability/misconfiguration scanner on container images, filesystems, or IaC configs. Returns structured vulnerability data with severity summary. Use instead of running `trivy` in the terminal.",
+        inputSchema: {
+            target: z
+                .string()
+                .max(INPUT_LIMITS.PATH_MAX)
+                .describe("Scan target: image name (e.g. 'alpine:3.18') or filesystem path"),
+            scanType: z
+                .enum(["image", "fs", "config"])
+                .optional()
+                .default("image")
+                .describe('Scan type: "image" for container images, "fs" for filesystem, "config" for IaC misconfigurations'),
+            severity: z
+                .string()
+                .max(INPUT_LIMITS.SHORT_STRING_MAX)
+                .optional()
+                .describe("Comma-separated severity filter (e.g. 'CRITICAL,HIGH'). Default: all severities"),
+            ignoreUnfixed: z
+                .boolean()
+                .optional()
+                .default(false)
+                .describe("Only show vulnerabilities with known fixes"),
+            path: z
+                .string()
+                .max(INPUT_LIMITS.PATH_MAX)
+                .optional()
+                .describe("Working directory (default: cwd)"),
+            compact: z
+                .boolean()
+                .optional()
+                .default(true)
+                .describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
+        },
+        outputSchema: TrivyScanResultSchema,
+    }, async ({ target, scanType, severity, ignoreUnfixed, path, compact }) => {
+        const cwd = path || process.cwd();
+        const args = [scanType, "--format", "json", "--quiet"];
+        if (severity) {
+            args.push("--severity", severity);
+        }
+        if (ignoreUnfixed) {
+            args.push("--ignore-unfixed");
+        }
+        args.push(target);
+        const result = await run("trivy", args, { cwd, timeout: 300_000 });
+        const data = parseTrivyJson(result.stdout, target, scanType);
+        const rawOutput = (result.stdout + "\n" + result.stderr).trim();
+        return compactDualOutput(data, rawOutput, formatTrivyScan, compactTrivyScanMap, formatTrivyScanCompact, compact === false);
+    });
+}
+//# sourceMappingURL=trivy.js.map

package/dist/tools/trivy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kNAAkN;QACpN,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC/B,QAAQ,EAAE;iBACV,OAAO,CAAC,OAAO,CAAC;iBAChB,QAAQ,CACP,kGAAkG,CACnG;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,iFAAiF,CAClF;YACH,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,4CAA4C,CAAC;YACzD,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,qBAAqB;KACpC,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAElC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEjE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@paretools/security",
+  "version": "0.1.0",
+  "mcpName": "io.github.Dave-London/pare-security",
+  "description": "MCP server for security scanning (Trivy, Semgrep, Gitleaks) with structured, token-efficient output",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "structured-output",
+    "ai",
+    "ai-agent",
+    "claude",
+    "cursor",
+    "copilot",
+    "token-efficient",
+    "devtools",
+    "cli",
+    "trivy",
+    "security",
+    "vulnerability",
+    "scanner",
+    "container",
+    "iac",
+    "semgrep",
+    "static-analysis",
+    "sast",
+    "gitleaks",
+    "secret-detection"
+  ],
+  "homepage": "https://github.com/Dave-London/Pare/tree/main/packages/server-security",
+  "engines": {
+    "node": ">=20"
+  },
+  "type": "module",
+  "bin": {
+    "pare-security": "./dist/index.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Dave-London/Pare.git",
+    "directory": "packages/server-security"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "zod": "^4.3.6",
+    "@paretools/shared": "0.8.1"
+  },
+  "devDependencies": {
+    "@types/node": "^25.2.3",
+    "typescript": "^5.7.0",
+    "vitest": "^4.0.18",
+    "@paretools/tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src/"
+  }
+}