@paretools/security 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/formatters.js +6 -6
- package/dist/lib/formatters.js.map +1 -1
- package/dist/schemas/index.d.ts +8 -8
- package/dist/schemas/index.js +4 -4
- package/dist/schemas/index.js.map +1 -1
- package/dist/tools/gitleaks.d.ts +1 -0
- package/dist/tools/gitleaks.d.ts.map +1 -1
- package/dist/tools/gitleaks.js +3 -1
- package/dist/tools/gitleaks.js.map +1 -1
- package/dist/tools/index.d.ts +1 -0
- package/dist/tools/index.d.ts.map +1 -1
- package/dist/tools/index.js +1 -0
- package/dist/tools/index.js.map +1 -1
- package/dist/tools/semgrep.d.ts +1 -0
- package/dist/tools/semgrep.d.ts.map +1 -1
- package/dist/tools/semgrep.js +11 -4
- package/dist/tools/semgrep.js.map +1 -1
- package/dist/tools/trivy.d.ts +1 -0
- package/dist/tools/trivy.d.ts.map +1 -1
- package/dist/tools/trivy.js +5 -4
- package/dist/tools/trivy.js.map +1 -1
- package/package.json +2 -2
package/dist/lib/formatters.js
CHANGED
|
@@ -7,9 +7,9 @@ export function formatTrivyScan(data) {
|
|
|
7
7
|
`${data.summary.critical} critical, ${data.summary.high} high, ` +
|
|
8
8
|
`${data.summary.medium} medium, ${data.summary.low} low, ` +
|
|
9
9
|
`${data.summary.unknown} unknown`);
|
|
10
|
-
if (data.vulnerabilities.length > 0) {
|
|
10
|
+
if ((data.vulnerabilities ?? []).length > 0) {
|
|
11
11
|
lines.push("");
|
|
12
|
-
for (const v of data.vulnerabilities) {
|
|
12
|
+
for (const v of data.vulnerabilities ?? []) {
|
|
13
13
|
const fixed = v.fixedVersion ? ` -> ${v.fixedVersion}` : "";
|
|
14
14
|
const title = v.title ? ` - ${v.title}` : "";
|
|
15
15
|
lines.push(` [${v.severity}] ${v.id}: ${v.package}@${v.installedVersion}${fixed}${title}`);
|
|
@@ -38,9 +38,9 @@ export function formatSemgrepScan(data) {
|
|
|
38
38
|
lines.push(`Found ${data.totalFindings} findings: ` +
|
|
39
39
|
`${data.summary.error} error, ${data.summary.warning} warning, ` +
|
|
40
40
|
`${data.summary.info} info`);
|
|
41
|
-
if (data.findings.length > 0) {
|
|
41
|
+
if ((data.findings ?? []).length > 0) {
|
|
42
42
|
lines.push("");
|
|
43
|
-
for (const f of data.findings) {
|
|
43
|
+
for (const f of data.findings ?? []) {
|
|
44
44
|
const category = f.category ? ` [${f.category}]` : "";
|
|
45
45
|
lines.push(` [${f.severity}] ${f.ruleId}: ${f.path}:${f.startLine}-${f.endLine}${category}`);
|
|
46
46
|
lines.push(` ${f.message}`);
|
|
@@ -66,9 +66,9 @@ export function formatGitleaksScan(data) {
|
|
|
66
66
|
const lines = [];
|
|
67
67
|
lines.push(`Gitleaks secret detection scan`);
|
|
68
68
|
lines.push(`Found ${data.totalFindings} secret(s)`);
|
|
69
|
-
if (data.findings.length > 0) {
|
|
69
|
+
if ((data.findings ?? []).length > 0) {
|
|
70
70
|
lines.push("");
|
|
71
|
-
for (const f of data.findings) {
|
|
71
|
+
for (const f of data.findings ?? []) {
|
|
72
72
|
const commit = f.commit ? ` (commit: ${f.commit.slice(0, 8)})` : "";
|
|
73
73
|
lines.push(` [${f.ruleID}] ${f.file}:${f.startLine}-${f.endLine}${commit}`);
|
|
74
74
|
lines.push(` ${f.description} -- secret: ${f.secret}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,oBAAoB,oBAAoB;QACpD,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;QAC1D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CACpC,CAAC;IAEF,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,oBAAoB,oBAAoB;QACpD,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;QAC1D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CACpC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAmBD,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,OAAO,CACL,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,MAAM;QACjD,GAAG,IAAI,CAAC,oBAAoB,mBAAmB;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,aAAa,aAAa;QACtC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,YAAY;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAC9B,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC9F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAwB;IAC/D,OAAO,CACL,yBAAyB,IAAI,CAAC,MAAM,OAAO;QAC3C,GAAG,IAAI,CAAC,aAAa,YAAY;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,YAAY,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,OAAO,oBAAoB,IAAI,CAAC,aAAa,qBAAqB,CAAC;AACrE,CAAC"}
|
package/dist/schemas/index.d.ts
CHANGED
|
@@ -26,14 +26,14 @@ export declare const TrivyScanResultSchema: z.ZodObject<{
|
|
|
26
26
|
fs: "fs";
|
|
27
27
|
config: "config";
|
|
28
28
|
}>;
|
|
29
|
-
vulnerabilities: z.ZodArray<z.ZodObject<{
|
|
29
|
+
vulnerabilities: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
30
30
|
id: z.ZodString;
|
|
31
31
|
severity: z.ZodString;
|
|
32
32
|
package: z.ZodString;
|
|
33
33
|
installedVersion: z.ZodString;
|
|
34
34
|
fixedVersion: z.ZodOptional<z.ZodString>;
|
|
35
35
|
title: z.ZodOptional<z.ZodString>;
|
|
36
|
-
}, z.core.$strip
|
|
36
|
+
}, z.core.$strip>>>;
|
|
37
37
|
summary: z.ZodObject<{
|
|
38
38
|
critical: z.ZodNumber;
|
|
39
39
|
high: z.ZodNumber;
|
|
@@ -65,7 +65,7 @@ export type SemgrepSeveritySummary = z.infer<typeof SemgrepSeveritySummarySchema
|
|
|
65
65
|
/** Zod schema for the structured Semgrep scan result. */
|
|
66
66
|
export declare const SemgrepScanResultSchema: z.ZodObject<{
|
|
67
67
|
totalFindings: z.ZodNumber;
|
|
68
|
-
findings: z.ZodArray<z.ZodObject<{
|
|
68
|
+
findings: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
69
69
|
ruleId: z.ZodString;
|
|
70
70
|
path: z.ZodString;
|
|
71
71
|
startLine: z.ZodNumber;
|
|
@@ -73,7 +73,7 @@ export declare const SemgrepScanResultSchema: z.ZodObject<{
|
|
|
73
73
|
message: z.ZodString;
|
|
74
74
|
severity: z.ZodString;
|
|
75
75
|
category: z.ZodOptional<z.ZodString>;
|
|
76
|
-
}, z.core.$strip
|
|
76
|
+
}, z.core.$strip>>>;
|
|
77
77
|
summary: z.ZodObject<{
|
|
78
78
|
error: z.ZodNumber;
|
|
79
79
|
warning: z.ZodNumber;
|
|
@@ -104,7 +104,7 @@ export type GitleaksSummary = z.infer<typeof GitleaksSummarySchema>;
|
|
|
104
104
|
/** Zod schema for the structured Gitleaks scan result. */
|
|
105
105
|
export declare const GitleaksScanResultSchema: z.ZodObject<{
|
|
106
106
|
totalFindings: z.ZodNumber;
|
|
107
|
-
findings: z.ZodArray<z.ZodObject<{
|
|
107
|
+
findings: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
108
108
|
ruleID: z.ZodString;
|
|
109
109
|
description: z.ZodString;
|
|
110
110
|
match: z.ZodString;
|
|
@@ -115,10 +115,10 @@ export declare const GitleaksScanResultSchema: z.ZodObject<{
|
|
|
115
115
|
commit: z.ZodString;
|
|
116
116
|
author: z.ZodString;
|
|
117
117
|
date: z.ZodString;
|
|
118
|
-
}, z.core.$strip
|
|
119
|
-
summary: z.ZodObject<{
|
|
118
|
+
}, z.core.$strip>>>;
|
|
119
|
+
summary: z.ZodOptional<z.ZodObject<{
|
|
120
120
|
totalFindings: z.ZodNumber;
|
|
121
|
-
}, z.core.$strip
|
|
121
|
+
}, z.core.$strip>>;
|
|
122
122
|
}, z.core.$strip>;
|
|
123
123
|
export type GitleaksScanResult = z.infer<typeof GitleaksScanResultSchema>;
|
|
124
124
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/schemas/index.js
CHANGED
|
@@ -20,7 +20,7 @@ export const TrivySeveritySummarySchema = z.object({
|
|
|
20
20
|
export const TrivyScanResultSchema = z.object({
|
|
21
21
|
target: z.string(),
|
|
22
22
|
scanType: z.enum(["image", "fs", "config"]),
|
|
23
|
-
vulnerabilities: z.array(TrivyVulnerabilitySchema),
|
|
23
|
+
vulnerabilities: z.array(TrivyVulnerabilitySchema).optional(),
|
|
24
24
|
summary: TrivySeveritySummarySchema,
|
|
25
25
|
totalVulnerabilities: z.number(),
|
|
26
26
|
});
|
|
@@ -44,7 +44,7 @@ export const SemgrepSeveritySummarySchema = z.object({
|
|
|
44
44
|
/** Zod schema for the structured Semgrep scan result. */
|
|
45
45
|
export const SemgrepScanResultSchema = z.object({
|
|
46
46
|
totalFindings: z.number(),
|
|
47
|
-
findings: z.array(SemgrepFindingSchema),
|
|
47
|
+
findings: z.array(SemgrepFindingSchema).optional(),
|
|
48
48
|
summary: SemgrepSeveritySummarySchema,
|
|
49
49
|
config: z.string(),
|
|
50
50
|
});
|
|
@@ -69,7 +69,7 @@ export const GitleaksSummarySchema = z.object({
|
|
|
69
69
|
/** Zod schema for the structured Gitleaks scan result. */
|
|
70
70
|
export const GitleaksScanResultSchema = z.object({
|
|
71
71
|
totalFindings: z.number(),
|
|
72
|
-
findings: z.array(GitleaksFindingSchema),
|
|
73
|
-
summary: GitleaksSummarySchema,
|
|
72
|
+
findings: z.array(GitleaksFindingSchema).optional(),
|
|
73
|
+
summary: GitleaksSummarySchema.optional(),
|
|
74
74
|
});
|
|
75
75
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAIH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC7D,OAAO,EAAE,0BAA0B;IACnC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;CACjC,CAAC,CAAC;AAIH,gFAAgF;AAEhF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,4BAA4B;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,gFAAgF;AAEhF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,uCAAuC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAIH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACnD,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}
|
package/dist/tools/gitleaks.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUzE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,
|
|
1
|
+
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAUzE,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,QAmErD"}
|
package/dist/tools/gitleaks.js
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
3
3
|
import { parseGitleaksJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatGitleaksScan, compactGitleaksScanMap, formatGitleaksScanCompact, } from "../lib/formatters.js";
|
|
5
5
|
import { GitleaksScanResultSchema } from "../schemas/index.js";
|
|
6
|
+
/** Registers the `gitleaks` tool on the given MCP server. */
|
|
6
7
|
export function registerGitleaksTool(server) {
|
|
7
8
|
server.registerTool("gitleaks", {
|
|
8
9
|
title: "Gitleaks Secret Detection",
|
|
@@ -32,6 +33,7 @@ export function registerGitleaksTool(server) {
|
|
|
32
33
|
outputSchema: GitleaksScanResultSchema,
|
|
33
34
|
}, async ({ path, noGit, verbose, compact }) => {
|
|
34
35
|
const cwd = path || process.cwd();
|
|
36
|
+
assertAllowedRoot(cwd, "security");
|
|
35
37
|
const args = ["detect", "--report-format", "json", "--report-path", "/dev/stdout"];
|
|
36
38
|
if (noGit) {
|
|
37
39
|
args.push("--no-git");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,0KAA0K;QAC5K,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,wCAAwC,CAAC;YACrD,KAAK,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CACP,qFAAqF,CACtF;YACH,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,qCAAqC,CAAC;YAClD,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,wBAAwB;KACvC,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAE7F,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3B,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/dist/tools/index.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,QAKjD"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,QAKjD"}
|
package/dist/tools/index.js
CHANGED
|
@@ -2,6 +2,7 @@ import { shouldRegisterTool } from "@paretools/shared";
|
|
|
2
2
|
import { registerTrivyTool } from "./trivy.js";
|
|
3
3
|
import { registerSemgrepTool } from "./semgrep.js";
|
|
4
4
|
import { registerGitleaksTool } from "./gitleaks.js";
|
|
5
|
+
/** Registers all security tools on the given MCP server, filtered by policy. */
|
|
5
6
|
export function registerAllTools(server) {
|
|
6
7
|
const s = (name) => shouldRegisterTool("security", name);
|
|
7
8
|
if (s("trivy"))
|
package/dist/tools/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,OAAO,CAAC;QAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,SAAS,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC;QAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,OAAO,CAAC;QAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,SAAS,CAAC;QAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC;QAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC"}
|
package/dist/tools/semgrep.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA8EpD"}
|
package/dist/tools/semgrep.js
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertNoFlagInjection, assertAllowedRoot, } from "@paretools/shared";
|
|
3
3
|
import { parseSemgrepJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatSemgrepScan, compactSemgrepScanMap, formatSemgrepScanCompact, } from "../lib/formatters.js";
|
|
5
5
|
import { SemgrepScanResultSchema } from "../schemas/index.js";
|
|
6
|
+
/** Registers the `semgrep` tool on the given MCP server. */
|
|
6
7
|
export function registerSemgrepTool(server) {
|
|
7
8
|
server.registerTool("semgrep", {
|
|
8
9
|
title: "Semgrep Static Analysis",
|
|
@@ -21,10 +22,9 @@ export function registerSemgrepTool(server) {
|
|
|
21
22
|
.default("auto")
|
|
22
23
|
.describe('Semgrep config/ruleset (e.g. "auto", "p/security-audit", "p/owasp-top-ten"). Default: "auto"'),
|
|
23
24
|
severity: z
|
|
24
|
-
.
|
|
25
|
-
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
25
|
+
.enum(["INFO", "WARNING", "ERROR"])
|
|
26
26
|
.optional()
|
|
27
|
-
.describe("
|
|
27
|
+
.describe("Severity filter. Default: all severities"),
|
|
28
28
|
path: z
|
|
29
29
|
.string()
|
|
30
30
|
.max(INPUT_LIMITS.PATH_MAX)
|
|
@@ -39,6 +39,13 @@ export function registerSemgrepTool(server) {
|
|
|
39
39
|
outputSchema: SemgrepScanResultSchema,
|
|
40
40
|
}, async ({ patterns, config, severity, path, compact }) => {
|
|
41
41
|
const cwd = path || process.cwd();
|
|
42
|
+
assertAllowedRoot(cwd, "security");
|
|
43
|
+
// Validate inputs against flag injection
|
|
44
|
+
if (config)
|
|
45
|
+
assertNoFlagInjection(config, "config");
|
|
46
|
+
for (const p of patterns) {
|
|
47
|
+
assertNoFlagInjection(p, "patterns");
|
|
48
|
+
}
|
|
42
49
|
const args = ["scan", "--json", "--quiet"];
|
|
43
50
|
if (config) {
|
|
44
51
|
args.push("--config", config);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,
|
|
1
|
+
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;iBACd,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CACP,8FAA8F,CAC/F;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACvD,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,uBAAuB;KACtC,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,yCAAyC;QACzC,IAAI,MAAM;YAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,qBAAqB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/dist/tools/trivy.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,
|
|
1
|
+
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAMzE,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA0ElD"}
|
package/dist/tools/trivy.js
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
3
3
|
import { parseTrivyJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatTrivyScan, compactTrivyScanMap, formatTrivyScanCompact } from "../lib/formatters.js";
|
|
5
5
|
import { TrivyScanResultSchema } from "../schemas/index.js";
|
|
6
|
+
/** Registers the `trivy` tool on the given MCP server. */
|
|
6
7
|
export function registerTrivyTool(server) {
|
|
7
8
|
server.registerTool("trivy", {
|
|
8
9
|
title: "Trivy Security Scanner",
|
|
@@ -18,10 +19,9 @@ export function registerTrivyTool(server) {
|
|
|
18
19
|
.default("image")
|
|
19
20
|
.describe('Scan type: "image" for container images, "fs" for filesystem, "config" for IaC misconfigurations'),
|
|
20
21
|
severity: z
|
|
21
|
-
.
|
|
22
|
-
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
22
|
+
.enum(["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"])
|
|
23
23
|
.optional()
|
|
24
|
-
.describe("
|
|
24
|
+
.describe("Severity filter. Default: all severities"),
|
|
25
25
|
ignoreUnfixed: z
|
|
26
26
|
.boolean()
|
|
27
27
|
.optional()
|
|
@@ -41,6 +41,7 @@ export function registerTrivyTool(server) {
|
|
|
41
41
|
outputSchema: TrivyScanResultSchema,
|
|
42
42
|
}, async ({ target, scanType, severity, ignoreUnfixed, path, compact }) => {
|
|
43
43
|
const cwd = path || process.cwd();
|
|
44
|
+
assertAllowedRoot(cwd, "security");
|
|
44
45
|
const args = [scanType, "--format", "json", "--quiet"];
|
|
45
46
|
if (severity) {
|
|
46
47
|
args.push("--severity", severity);
|
package/dist/tools/trivy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kNAAkN;QACpN,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC/B,QAAQ,EAAE;iBACV,OAAO,CAAC,OAAO,CAAC;iBAChB,QAAQ,CACP,kGAAkG,CACnG;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;iBACtD,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACvD,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,4CAA4C,CAAC;YACzD,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,qBAAqB;KACpC,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEjE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@paretools/security",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"mcpName": "io.github.Dave-London/pare-security",
|
|
5
5
|
"description": "MCP server for security scanning (Trivy, Semgrep, Gitleaks) with structured, token-efficient output",
|
|
6
6
|
"license": "MIT",
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
"dependencies": {
|
|
58
58
|
"@modelcontextprotocol/sdk": "^1.26.0",
|
|
59
59
|
"zod": "^4.3.6",
|
|
60
|
-
"@paretools/shared": "0.8.
|
|
60
|
+
"@paretools/shared": "0.8.2"
|
|
61
61
|
},
|
|
62
62
|
"devDependencies": {
|
|
63
63
|
"@types/node": "^25.2.3",
|