@paretools/security 0.8.5 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/lib/formatters.d.ts.map +1 -1
- package/dist/lib/formatters.js +18 -2
- package/dist/lib/formatters.js.map +1 -1
- package/dist/lib/parsers.d.ts.map +1 -1
- package/dist/lib/parsers.js +51 -2
- package/dist/lib/parsers.js.map +1 -1
- package/dist/schemas/index.d.ts +11 -0
- package/dist/schemas/index.d.ts.map +1 -1
- package/dist/schemas/index.js +10 -0
- package/dist/schemas/index.js.map +1 -1
- package/dist/tools/gitleaks.d.ts.map +1 -1
- package/dist/tools/gitleaks.js +82 -8
- package/dist/tools/gitleaks.js.map +1 -1
- package/dist/tools/semgrep.d.ts.map +1 -1
- package/dist/tools/semgrep.js +90 -16
- package/dist/tools/semgrep.js.map +1 -1
- package/dist/tools/trivy.d.ts.map +1 -1
- package/dist/tools/trivy.js +94 -14
- package/dist/tools/trivy.js.map +1 -1
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -3,7 +3,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
|
|
|
3
3
|
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
|
|
4
4
|
import { registerAllTools } from "./tools/index.js";
|
|
5
5
|
const server = new McpServer({ name: "@paretools/security", version: "0.1.0" }, {
|
|
6
|
-
instructions: "Structured security scanning operations (trivy, semgrep, gitleaks). Returns typed JSON with vulnerability and finding data.
|
|
6
|
+
instructions: "Structured security scanning operations (trivy, semgrep, gitleaks). Returns typed JSON with vulnerability and finding data.",
|
|
7
7
|
});
|
|
8
8
|
registerAllTools(server);
|
|
9
9
|
const transport = new StdioServerTransport();
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD;IACE,YAAY,EACV,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD;IACE,YAAY,EACV,6HAA6H;CAChI,CACF,CAAC;AAEF,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAEzB,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"formatters.d.ts","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIlG,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"formatters.d.ts","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIlG,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAwB7D;AAID,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,CAAC;IACpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,eAAe,GAAG,gBAAgB,CAO3E;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAID,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CA+BjE;AAID,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,CAMjF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAMzE;AAID,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAuBnE;AAID,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,GAAG,mBAAmB,CAIpF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAE3E"}
|
package/dist/lib/formatters.js
CHANGED
|
@@ -12,7 +12,8 @@ export function formatTrivyScan(data) {
|
|
|
12
12
|
for (const v of data.vulnerabilities ?? []) {
|
|
13
13
|
const fixed = v.fixedVersion ? ` -> ${v.fixedVersion}` : "";
|
|
14
14
|
const title = v.title ? ` - ${v.title}` : "";
|
|
15
|
-
|
|
15
|
+
const cvss = v.cvssScore !== undefined ? ` (CVSS ${v.cvssScore})` : "";
|
|
16
|
+
lines.push(` [${v.severity}] ${v.id}: ${v.package}@${v.installedVersion}${fixed}${cvss}${title}`);
|
|
16
17
|
}
|
|
17
18
|
}
|
|
18
19
|
return lines.join("\n");
|
|
@@ -42,8 +43,18 @@ export function formatSemgrepScan(data) {
|
|
|
42
43
|
lines.push("");
|
|
43
44
|
for (const f of data.findings ?? []) {
|
|
44
45
|
const category = f.category ? ` [${f.category}]` : "";
|
|
46
|
+
const cwe = (f.cwe ?? []).length > 0 ? ` CWE: ${(f.cwe ?? []).join(",")}` : "";
|
|
45
47
|
lines.push(` [${f.severity}] ${f.ruleId}: ${f.path}:${f.startLine}-${f.endLine}${category}`);
|
|
46
|
-
lines.push(` ${f.message}`);
|
|
48
|
+
lines.push(` ${f.message}${cwe}`);
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
if ((data.errors ?? []).length > 0) {
|
|
52
|
+
lines.push("");
|
|
53
|
+
lines.push(`Errors: ${data.errors?.length ?? 0}`);
|
|
54
|
+
for (const err of data.errors ?? []) {
|
|
55
|
+
const type = err.type ? `[${err.type}] ` : "";
|
|
56
|
+
const path = err.path ? ` (${err.path})` : "";
|
|
57
|
+
lines.push(` ${type}${err.message}${path}`);
|
|
47
58
|
}
|
|
48
59
|
}
|
|
49
60
|
return lines.join("\n");
|
|
@@ -66,6 +77,11 @@ export function formatGitleaksScan(data) {
|
|
|
66
77
|
const lines = [];
|
|
67
78
|
lines.push(`Gitleaks secret detection scan`);
|
|
68
79
|
lines.push(`Found ${data.totalFindings} secret(s)`);
|
|
80
|
+
if (data.summary?.ruleCounts && Object.keys(data.summary.ruleCounts).length > 0) {
|
|
81
|
+
lines.push(`Rule counts: ${Object.entries(data.summary.ruleCounts)
|
|
82
|
+
.map(([rule, count]) => `${rule}=${count}`)
|
|
83
|
+
.join(", ")}`);
|
|
84
|
+
}
|
|
69
85
|
if ((data.findings ?? []).length > 0) {
|
|
70
86
|
lines.push("");
|
|
71
87
|
for (const f of data.findings ?? []) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,oBAAoB,oBAAoB;QACpD,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;QAC1D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CACpC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,
|
|
1
|
+
{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAEhF,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,IAAqB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,oBAAoB,oBAAoB;QACpD,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ;QAC1D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,UAAU,CACpC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAmBD,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACvD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAsB;IAC3D,OAAO,CACL,SAAS,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,MAAM,MAAM;QACjD,GAAG,IAAI,CAAC,oBAAoB,mBAAmB;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CACR,SAAS,IAAI,CAAC,aAAa,aAAa;QACtC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,YAAY;QAChE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAC9B,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAC9F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAwB;IAC/D,OAAO,CACL,yBAAyB,IAAI,CAAC,MAAM,OAAO;QAC3C,GAAG,IAAI,CAAC,aAAa,YAAY;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,YAAY,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,OAAO,oBAAoB,IAAI,CAAC,aAAa,qBAAqB,CAAC;AACrE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAGf,iBAAiB,EAGjB,kBAAkB,EAEnB,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EAGf,iBAAiB,EAGjB,kBAAkB,EAEnB,MAAM,qBAAqB,CAAC;AAkC7B;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAAG,IAAI,GAAG,QAAQ,GAClC,eAAe,CA2DjB;AAiFD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAgDnF;AA2ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAwCrE"}
|
package/dist/lib/parsers.js
CHANGED
|
@@ -25,6 +25,7 @@ export function parseTrivyJson(jsonStr, target, scanType) {
|
|
|
25
25
|
// Handle regular vulnerabilities
|
|
26
26
|
if (result.Vulnerabilities) {
|
|
27
27
|
for (const v of result.Vulnerabilities) {
|
|
28
|
+
const cvssScore = extractCvssScore(v);
|
|
28
29
|
vulnerabilities.push({
|
|
29
30
|
id: v.VulnerabilityID || "UNKNOWN",
|
|
30
31
|
severity: normalizeSeverity(v.Severity),
|
|
@@ -32,6 +33,7 @@ export function parseTrivyJson(jsonStr, target, scanType) {
|
|
|
32
33
|
installedVersion: v.InstalledVersion || "unknown",
|
|
33
34
|
fixedVersion: v.FixedVersion || undefined,
|
|
34
35
|
title: v.Title || undefined,
|
|
36
|
+
...(cvssScore !== undefined ? { cvssScore } : {}),
|
|
35
37
|
});
|
|
36
38
|
}
|
|
37
39
|
}
|
|
@@ -68,6 +70,22 @@ function normalizeSeverity(severity) {
|
|
|
68
70
|
return upper;
|
|
69
71
|
return upper;
|
|
70
72
|
}
|
|
73
|
+
/** Extracts the highest CVSS score available from Trivy vulnerability metadata. */
|
|
74
|
+
function extractCvssScore(vuln) {
|
|
75
|
+
const cvss = vuln.CVSS;
|
|
76
|
+
if (!cvss)
|
|
77
|
+
return undefined;
|
|
78
|
+
const scores = [];
|
|
79
|
+
for (const source of Object.values(cvss)) {
|
|
80
|
+
if (typeof source.V3Score === "number" && Number.isFinite(source.V3Score)) {
|
|
81
|
+
scores.push(source.V3Score);
|
|
82
|
+
}
|
|
83
|
+
else if (typeof source.Score === "number" && Number.isFinite(source.Score)) {
|
|
84
|
+
scores.push(source.Score);
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
return scores.length > 0 ? Math.max(...scores) : undefined;
|
|
88
|
+
}
|
|
71
89
|
/** Computes severity summary counts from a list of vulnerabilities. */
|
|
72
90
|
function computeSummary(vulnerabilities) {
|
|
73
91
|
const summary = { critical: 0, high: 0, medium: 0, low: 0, unknown: 0 };
|
|
@@ -114,6 +132,7 @@ export function parseSemgrepJson(jsonStr, config) {
|
|
|
114
132
|
const findings = [];
|
|
115
133
|
if (parsed.results) {
|
|
116
134
|
for (const r of parsed.results) {
|
|
135
|
+
const cwe = normalizeCwe(r.extra?.metadata?.cwe);
|
|
117
136
|
findings.push({
|
|
118
137
|
ruleId: r.check_id || "unknown",
|
|
119
138
|
path: r.path || "unknown",
|
|
@@ -122,13 +141,22 @@ export function parseSemgrepJson(jsonStr, config) {
|
|
|
122
141
|
message: r.extra?.message || "",
|
|
123
142
|
severity: normalizeSemgrepSeverity(r.extra?.severity),
|
|
124
143
|
category: r.extra?.metadata?.category || undefined,
|
|
144
|
+
...(cwe ? { cwe } : {}),
|
|
125
145
|
});
|
|
126
146
|
}
|
|
127
147
|
}
|
|
128
148
|
const summary = computeSemgrepSummary(findings);
|
|
149
|
+
const errors = (parsed.errors ?? [])
|
|
150
|
+
.map((err) => ({
|
|
151
|
+
type: err.type,
|
|
152
|
+
message: err.message || "Unknown semgrep error",
|
|
153
|
+
path: err.path,
|
|
154
|
+
}))
|
|
155
|
+
.filter((err) => err.message.length > 0);
|
|
129
156
|
return {
|
|
130
157
|
totalFindings: findings.length,
|
|
131
158
|
findings,
|
|
159
|
+
...(errors.length > 0 ? { errors } : {}),
|
|
132
160
|
summary,
|
|
133
161
|
config,
|
|
134
162
|
};
|
|
@@ -142,6 +170,21 @@ function normalizeSemgrepSeverity(severity) {
|
|
|
142
170
|
return upper;
|
|
143
171
|
return upper;
|
|
144
172
|
}
|
|
173
|
+
/** Normalizes Semgrep CWE metadata to a string array. */
|
|
174
|
+
function normalizeCwe(metadataCwe) {
|
|
175
|
+
if (Array.isArray(metadataCwe)) {
|
|
176
|
+
const values = metadataCwe.map((x) => String(x).trim()).filter((x) => x.length > 0);
|
|
177
|
+
return values.length > 0 ? values : undefined;
|
|
178
|
+
}
|
|
179
|
+
if (typeof metadataCwe === "string") {
|
|
180
|
+
const values = metadataCwe
|
|
181
|
+
.split(/[,\s]+/)
|
|
182
|
+
.map((x) => x.trim())
|
|
183
|
+
.filter((x) => x.length > 0);
|
|
184
|
+
return values.length > 0 ? values : undefined;
|
|
185
|
+
}
|
|
186
|
+
return undefined;
|
|
187
|
+
}
|
|
145
188
|
/** Computes severity summary counts from a list of Semgrep findings. */
|
|
146
189
|
function computeSemgrepSummary(findings) {
|
|
147
190
|
const summary = { error: 0, warning: 0, info: 0 };
|
|
@@ -194,9 +237,11 @@ export function parseGitleaksJson(jsonStr) {
|
|
|
194
237
|
return { totalFindings: 0, findings: [], summary: { totalFindings: 0 } };
|
|
195
238
|
}
|
|
196
239
|
const findings = [];
|
|
240
|
+
const ruleCounts = {};
|
|
197
241
|
for (const f of parsed) {
|
|
242
|
+
const ruleID = f.RuleID || "unknown";
|
|
198
243
|
findings.push({
|
|
199
|
-
ruleID
|
|
244
|
+
ruleID,
|
|
200
245
|
description: f.Description || "",
|
|
201
246
|
match: f.Match || "",
|
|
202
247
|
secret: redactSecret(f.Secret || ""),
|
|
@@ -207,11 +252,15 @@ export function parseGitleaksJson(jsonStr) {
|
|
|
207
252
|
author: f.Author || "",
|
|
208
253
|
date: f.Date || "",
|
|
209
254
|
});
|
|
255
|
+
ruleCounts[ruleID] = (ruleCounts[ruleID] ?? 0) + 1;
|
|
210
256
|
}
|
|
211
257
|
return {
|
|
212
258
|
totalFindings: findings.length,
|
|
213
259
|
findings,
|
|
214
|
-
summary: {
|
|
260
|
+
summary: {
|
|
261
|
+
totalFindings: findings.length,
|
|
262
|
+
...(Object.keys(ruleCounts).length > 0 ? { ruleCounts } : {}),
|
|
263
|
+
},
|
|
215
264
|
};
|
|
216
265
|
}
|
|
217
266
|
//# sourceMappingURL=parsers.js.map
|
package/dist/lib/parsers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../../src/lib/parsers.ts"],"names":[],"mappings":"AA2CA;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,MAAc,EACd,QAAmC;IAEnC,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM;YACN,QAAQ;YACR,eAAe,EAAE,EAAE;YACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;YAChE,oBAAoB,EAAE,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAyB,EAAE,CAAC;IAEjD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,iCAAiC;YACjC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACtC,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;wBAClC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;wBAC/B,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;wBACjD,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;wBACzC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;wBAC3B,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACzC,eAAe,CAAC,IAAI,CAAC;wBACnB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,SAAS;wBACrB,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACvC,OAAO,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ;wBAC3B,gBAAgB,EAAE,KAAK;wBACvB,YAAY,EAAE,SAAS;wBACvB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS;qBACzC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IAEhD,OAAO;QACL,MAAM;QACN,QAAQ;QACR,eAAe;QACf,OAAO;QACP,oBAAoB,EAAE,eAAe,CAAC,MAAM;KAC7C,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB,CAAC,QAA4B;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,uEAAuE;AACvE,SAAS,cAAc,CAAC,eAAqC;IAC3D,MAAM,OAAO,GAAyB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9F,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,UAAU;gBACb,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM;YACR,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM;YACR,KAAK,KAAK;gBACR,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,MAAM;YACR;gBACE,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAiCD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE;YAC1C,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC;gBAC7B,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;gBACzB,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE;gBAC/B,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;gBACrD,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS;gBAClD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,uBAAuB;QAC/C,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,wBAAwB,CAAC,QAA4B;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,WAA0C;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,WAAW;aACvB,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,QAA0B;IACvD,MAAM,OAAO,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM;YACR,KAAK,MAAM;gBACT,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;YACR;gBACE,iCAAiC;gBACjC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAA4B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;YACzB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC;YAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;SACnB,CAAC,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,QAAQ;QACR,OAAO,EAAE;YACP,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;KACF,CAAC;AACJ,CAAC"}
|
package/dist/schemas/index.d.ts
CHANGED
|
@@ -7,6 +7,7 @@ export declare const TrivyVulnerabilitySchema: z.ZodObject<{
|
|
|
7
7
|
installedVersion: z.ZodString;
|
|
8
8
|
fixedVersion: z.ZodOptional<z.ZodString>;
|
|
9
9
|
title: z.ZodOptional<z.ZodString>;
|
|
10
|
+
cvssScore: z.ZodOptional<z.ZodNumber>;
|
|
10
11
|
}, z.core.$strip>;
|
|
11
12
|
export type TrivyVulnerability = z.infer<typeof TrivyVulnerabilitySchema>;
|
|
12
13
|
/** Zod schema for severity summary counts. */
|
|
@@ -33,6 +34,7 @@ export declare const TrivyScanResultSchema: z.ZodObject<{
|
|
|
33
34
|
installedVersion: z.ZodString;
|
|
34
35
|
fixedVersion: z.ZodOptional<z.ZodString>;
|
|
35
36
|
title: z.ZodOptional<z.ZodString>;
|
|
37
|
+
cvssScore: z.ZodOptional<z.ZodNumber>;
|
|
36
38
|
}, z.core.$strip>>>;
|
|
37
39
|
summary: z.ZodObject<{
|
|
38
40
|
critical: z.ZodNumber;
|
|
@@ -53,6 +55,7 @@ export declare const SemgrepFindingSchema: z.ZodObject<{
|
|
|
53
55
|
message: z.ZodString;
|
|
54
56
|
severity: z.ZodString;
|
|
55
57
|
category: z.ZodOptional<z.ZodString>;
|
|
58
|
+
cwe: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
56
59
|
}, z.core.$strip>;
|
|
57
60
|
export type SemgrepFinding = z.infer<typeof SemgrepFindingSchema>;
|
|
58
61
|
/** Zod schema for Semgrep severity summary counts. */
|
|
@@ -73,6 +76,12 @@ export declare const SemgrepScanResultSchema: z.ZodObject<{
|
|
|
73
76
|
message: z.ZodString;
|
|
74
77
|
severity: z.ZodString;
|
|
75
78
|
category: z.ZodOptional<z.ZodString>;
|
|
79
|
+
cwe: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
80
|
+
}, z.core.$strip>>>;
|
|
81
|
+
errors: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
82
|
+
type: z.ZodOptional<z.ZodString>;
|
|
83
|
+
message: z.ZodString;
|
|
84
|
+
path: z.ZodOptional<z.ZodString>;
|
|
76
85
|
}, z.core.$strip>>>;
|
|
77
86
|
summary: z.ZodObject<{
|
|
78
87
|
error: z.ZodNumber;
|
|
@@ -99,6 +108,7 @@ export type GitleaksFinding = z.infer<typeof GitleaksFindingSchema>;
|
|
|
99
108
|
/** Zod schema for Gitleaks summary. */
|
|
100
109
|
export declare const GitleaksSummarySchema: z.ZodObject<{
|
|
101
110
|
totalFindings: z.ZodNumber;
|
|
111
|
+
ruleCounts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
|
|
102
112
|
}, z.core.$strip>;
|
|
103
113
|
export type GitleaksSummary = z.infer<typeof GitleaksSummarySchema>;
|
|
104
114
|
/** Zod schema for the structured Gitleaks scan result. */
|
|
@@ -118,6 +128,7 @@ export declare const GitleaksScanResultSchema: z.ZodObject<{
|
|
|
118
128
|
}, z.core.$strip>>>;
|
|
119
129
|
summary: z.ZodOptional<z.ZodObject<{
|
|
120
130
|
totalFindings: z.ZodNumber;
|
|
131
|
+
ruleCounts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
|
|
121
132
|
}, z.core.$strip>>;
|
|
122
133
|
}, z.core.$strip>;
|
|
123
134
|
export type GitleaksScanResult = z.infer<typeof GitleaksScanResultSchema>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,eAAO,MAAM,wBAAwB
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;iBAQnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,uDAAuD;AACvD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;iBAMhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,+CAA+C;AAC/C,eAAO,MAAM,oBAAoB;;;;;;;;;iBAS/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sDAAsD;AACtD,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,yDAAyD;AACzD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE,gDAAgD;AAChD,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAWhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,uCAAuC;AACvC,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
|
package/dist/schemas/index.js
CHANGED
|
@@ -7,6 +7,7 @@ export const TrivyVulnerabilitySchema = z.object({
|
|
|
7
7
|
installedVersion: z.string(),
|
|
8
8
|
fixedVersion: z.string().optional(),
|
|
9
9
|
title: z.string().optional(),
|
|
10
|
+
cvssScore: z.number().optional(),
|
|
10
11
|
});
|
|
11
12
|
/** Zod schema for severity summary counts. */
|
|
12
13
|
export const TrivySeveritySummarySchema = z.object({
|
|
@@ -34,6 +35,7 @@ export const SemgrepFindingSchema = z.object({
|
|
|
34
35
|
message: z.string(),
|
|
35
36
|
severity: z.string(),
|
|
36
37
|
category: z.string().optional(),
|
|
38
|
+
cwe: z.array(z.string()).optional(),
|
|
37
39
|
});
|
|
38
40
|
/** Zod schema for Semgrep severity summary counts. */
|
|
39
41
|
export const SemgrepSeveritySummarySchema = z.object({
|
|
@@ -45,6 +47,13 @@ export const SemgrepSeveritySummarySchema = z.object({
|
|
|
45
47
|
export const SemgrepScanResultSchema = z.object({
|
|
46
48
|
totalFindings: z.number(),
|
|
47
49
|
findings: z.array(SemgrepFindingSchema).optional(),
|
|
50
|
+
errors: z
|
|
51
|
+
.array(z.object({
|
|
52
|
+
type: z.string().optional(),
|
|
53
|
+
message: z.string(),
|
|
54
|
+
path: z.string().optional(),
|
|
55
|
+
}))
|
|
56
|
+
.optional(),
|
|
48
57
|
summary: SemgrepSeveritySummarySchema,
|
|
49
58
|
config: z.string(),
|
|
50
59
|
});
|
|
@@ -65,6 +74,7 @@ export const GitleaksFindingSchema = z.object({
|
|
|
65
74
|
/** Zod schema for Gitleaks summary. */
|
|
66
75
|
export const GitleaksSummarySchema = z.object({
|
|
67
76
|
totalFindings: z.number(),
|
|
77
|
+
ruleCounts: z.record(z.string(), z.number()).optional(),
|
|
68
78
|
});
|
|
69
79
|
/** Zod schema for the structured Gitleaks scan result. */
|
|
70
80
|
export const GitleaksScanResultSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAIH,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC7D,OAAO,EAAE,0BAA0B;IACnC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;CACjC,CAAC,CAAC;AAIH,gFAAgF;AAEhF,+CAA+C;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,sDAAsD;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC;SACN,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC,CACH;SACA,QAAQ,EAAE;IACb,OAAO,EAAE,4BAA4B;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,gFAAgF;AAEhF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAIH,uCAAuC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAIH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACnD,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,QAqKrD"}
|
package/dist/tools/gitleaks.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot, assertNoFlagInjection, } from "@paretools/shared";
|
|
3
3
|
import { parseGitleaksJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatGitleaksScan, compactGitleaksScanMap, formatGitleaksScanCompact, } from "../lib/formatters.js";
|
|
5
5
|
import { GitleaksScanResultSchema } from "../schemas/index.js";
|
|
@@ -7,13 +7,35 @@ import { GitleaksScanResultSchema } from "../schemas/index.js";
|
|
|
7
7
|
export function registerGitleaksTool(server) {
|
|
8
8
|
server.registerTool("gitleaks", {
|
|
9
9
|
title: "Gitleaks Secret Detection",
|
|
10
|
-
description: "Runs Gitleaks to detect hardcoded secrets in git repositories. Returns structured finding data with redacted secrets.
|
|
10
|
+
description: "Runs Gitleaks to detect hardcoded secrets in git repositories. Returns structured finding data with redacted secrets.",
|
|
11
11
|
inputSchema: {
|
|
12
|
-
path: z
|
|
12
|
+
path: z.string().max(INPUT_LIMITS.PATH_MAX).optional().describe("Repository path to scan"),
|
|
13
|
+
redact: z
|
|
14
|
+
.boolean()
|
|
15
|
+
.optional()
|
|
16
|
+
.default(true)
|
|
17
|
+
.describe("Redact raw secrets in output (--redact). Defaults to true to prevent secret leakage to LLM context."),
|
|
18
|
+
config: z
|
|
19
|
+
.string()
|
|
20
|
+
.max(INPUT_LIMITS.PATH_MAX)
|
|
21
|
+
.optional()
|
|
22
|
+
.describe("Path to custom gitleaks rule file (--config)"),
|
|
23
|
+
baselinePath: z
|
|
13
24
|
.string()
|
|
14
25
|
.max(INPUT_LIMITS.PATH_MAX)
|
|
15
26
|
.optional()
|
|
16
|
-
.describe("
|
|
27
|
+
.describe("Path to baseline report for differential scanning (--baseline-path)"),
|
|
28
|
+
logOpts: z
|
|
29
|
+
.string()
|
|
30
|
+
.max(INPUT_LIMITS.STRING_MAX)
|
|
31
|
+
.optional()
|
|
32
|
+
.describe("Git log options for scanning specific commit ranges/time windows (--log-opts, e.g., '--since=2024-01-01')"),
|
|
33
|
+
enableRule: z
|
|
34
|
+
.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX))
|
|
35
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
36
|
+
.optional()
|
|
37
|
+
.default([])
|
|
38
|
+
.describe("Enable specific rules by ID (--enable-rule, e.g., ['aws-access-key'])"),
|
|
17
39
|
noGit: z
|
|
18
40
|
.boolean()
|
|
19
41
|
.optional()
|
|
@@ -24,23 +46,75 @@ export function registerGitleaksTool(server) {
|
|
|
24
46
|
.optional()
|
|
25
47
|
.default(false)
|
|
26
48
|
.describe("Enable verbose output from gitleaks"),
|
|
27
|
-
|
|
49
|
+
followSymlinks: z
|
|
28
50
|
.boolean()
|
|
29
51
|
.optional()
|
|
30
|
-
.
|
|
31
|
-
|
|
52
|
+
.describe("Follow symbolic links during scan (--follow-symlinks)"),
|
|
53
|
+
maxTargetMegabytes: z
|
|
54
|
+
.number()
|
|
55
|
+
.optional()
|
|
56
|
+
.describe("Skip files larger than this size in MB (--max-target-megabytes)"),
|
|
57
|
+
logLevel: z
|
|
58
|
+
.string()
|
|
59
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
60
|
+
.optional()
|
|
61
|
+
.describe("Log level for gitleaks output (--log-level, e.g. 'debug', 'info', 'warn', 'error')"),
|
|
62
|
+
exitCode: z
|
|
63
|
+
.number()
|
|
64
|
+
.optional()
|
|
65
|
+
.describe("Exit code when findings are detected (--exit-code)"),
|
|
66
|
+
compact: z.boolean().optional().default(true).describe("Prefer compact output"),
|
|
32
67
|
},
|
|
33
68
|
outputSchema: GitleaksScanResultSchema,
|
|
34
|
-
}, async ({ path, noGit, verbose, compact }) => {
|
|
69
|
+
}, async ({ path, redact, config, baselinePath, logOpts, enableRule, noGit, verbose, followSymlinks, maxTargetMegabytes, logLevel, exitCode, compact, }) => {
|
|
70
|
+
if (config)
|
|
71
|
+
assertNoFlagInjection(config, "config");
|
|
72
|
+
if (baselinePath)
|
|
73
|
+
assertNoFlagInjection(baselinePath, "baselinePath");
|
|
74
|
+
if (logOpts)
|
|
75
|
+
assertNoFlagInjection(logOpts, "logOpts");
|
|
76
|
+
if (logLevel)
|
|
77
|
+
assertNoFlagInjection(logLevel, "logLevel");
|
|
78
|
+
for (const r of enableRule ?? []) {
|
|
79
|
+
assertNoFlagInjection(r, "enableRule");
|
|
80
|
+
}
|
|
35
81
|
const cwd = path || process.cwd();
|
|
36
82
|
assertAllowedRoot(cwd, "security");
|
|
37
83
|
const args = ["detect", "--report-format", "json", "--report-path", "/dev/stdout"];
|
|
84
|
+
// Default to redacting secrets to prevent leakage
|
|
85
|
+
if (redact !== false) {
|
|
86
|
+
args.push("--redact");
|
|
87
|
+
}
|
|
88
|
+
if (config) {
|
|
89
|
+
args.push("--config", config);
|
|
90
|
+
}
|
|
91
|
+
if (baselinePath) {
|
|
92
|
+
args.push("--baseline-path", baselinePath);
|
|
93
|
+
}
|
|
94
|
+
if (logOpts) {
|
|
95
|
+
args.push("--log-opts", logOpts);
|
|
96
|
+
}
|
|
97
|
+
for (const r of enableRule ?? []) {
|
|
98
|
+
args.push("--enable-rule", r);
|
|
99
|
+
}
|
|
38
100
|
if (noGit) {
|
|
39
101
|
args.push("--no-git");
|
|
40
102
|
}
|
|
41
103
|
if (verbose) {
|
|
42
104
|
args.push("--verbose");
|
|
43
105
|
}
|
|
106
|
+
if (followSymlinks) {
|
|
107
|
+
args.push("--follow-symlinks");
|
|
108
|
+
}
|
|
109
|
+
if (maxTargetMegabytes !== undefined) {
|
|
110
|
+
args.push("--max-target-megabytes", String(maxTargetMegabytes));
|
|
111
|
+
}
|
|
112
|
+
if (logLevel) {
|
|
113
|
+
args.push("--log-level", logLevel);
|
|
114
|
+
}
|
|
115
|
+
if (exitCode !== undefined) {
|
|
116
|
+
args.push("--exit-code", String(exitCode));
|
|
117
|
+
}
|
|
44
118
|
args.push("--source", cwd);
|
|
45
119
|
// gitleaks exits with code 1 when findings are detected, which is not an error
|
|
46
120
|
const result = await run("gitleaks", args, { cwd, timeout: 300_000 });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,
|
|
1
|
+
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,uHAAuH;QACzH,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAC1F,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,qGAAqG,CACtG;YACH,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;iBACpD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,uEAAuE,CAAC;YACpF,KAAK,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CACP,qFAAqF,CACtF;YACH,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,qCAAqC,CAAC;YAClD,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,oFAAoF,CACrF;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,oDAAoD,CAAC;YACjE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SAChF;QACD,YAAY,EAAE,wBAAwB;KACvC,EACD,KAAK,EAAE,EACL,IAAI,EACJ,MAAM,EACN,MAAM,EACN,YAAY,EACZ,OAAO,EACP,UAAU,EACV,KAAK,EACL,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,QAAQ,EACR,OAAO,GACR,EAAE,EAAE;QACH,IAAI,MAAM;YAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,YAAY;YAAE,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACjC,qBAAqB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAE7F,kDAAkD;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3B,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,
|
|
1
|
+
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QAiLpD"}
|
package/dist/tools/semgrep.js
CHANGED
|
@@ -7,7 +7,7 @@ import { SemgrepScanResultSchema } from "../schemas/index.js";
|
|
|
7
7
|
export function registerSemgrepTool(server) {
|
|
8
8
|
server.registerTool("semgrep", {
|
|
9
9
|
title: "Semgrep Static Analysis",
|
|
10
|
-
description: "Runs Semgrep static analysis with structured rules and findings. Returns structured finding data with severity summary.
|
|
10
|
+
description: "Runs Semgrep static analysis with structured rules and findings. Returns structured finding data with severity summary.",
|
|
11
11
|
inputSchema: {
|
|
12
12
|
patterns: z
|
|
13
13
|
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
@@ -16,46 +16,120 @@ export function registerSemgrepTool(server) {
|
|
|
16
16
|
.default(["."])
|
|
17
17
|
.describe("File patterns or paths to scan (default: ['.'])"),
|
|
18
18
|
config: z
|
|
19
|
-
.
|
|
20
|
-
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
19
|
+
.union([
|
|
20
|
+
z.string().max(INPUT_LIMITS.SHORT_STRING_MAX),
|
|
21
|
+
z.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX)).max(INPUT_LIMITS.ARRAY_MAX),
|
|
22
|
+
])
|
|
21
23
|
.optional()
|
|
22
24
|
.default("auto")
|
|
23
|
-
.describe('Semgrep config/ruleset (e.g
|
|
25
|
+
.describe('Semgrep config/ruleset(s). String or string[] for multiple configs (e.g., "auto", "p/security-audit", ["p/owasp-top-ten", "p/cwe-top-25"]). Default: "auto"'),
|
|
24
26
|
severity: z
|
|
25
27
|
.enum(["INFO", "WARNING", "ERROR"])
|
|
26
28
|
.optional()
|
|
27
29
|
.describe("Severity filter. Default: all severities"),
|
|
28
|
-
|
|
30
|
+
exclude: z
|
|
31
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
32
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
33
|
+
.optional()
|
|
34
|
+
.default([])
|
|
35
|
+
.describe("Glob patterns to exclude from scanning (--exclude)"),
|
|
36
|
+
include: z
|
|
37
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
38
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
39
|
+
.optional()
|
|
40
|
+
.default([])
|
|
41
|
+
.describe("Glob patterns to include in scanning (--include)"),
|
|
42
|
+
excludeRule: z
|
|
43
|
+
.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX))
|
|
44
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
45
|
+
.optional()
|
|
46
|
+
.default([])
|
|
47
|
+
.describe("Rule IDs to suppress (--exclude-rule, for known false positives)"),
|
|
48
|
+
baselineCommit: z
|
|
29
49
|
.string()
|
|
30
|
-
.max(INPUT_LIMITS.
|
|
50
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
31
51
|
.optional()
|
|
32
|
-
.describe("
|
|
33
|
-
|
|
52
|
+
.describe("Baseline commit for differential scanning in PR workflows (--baseline-commit)"),
|
|
53
|
+
dataflowTraces: z
|
|
34
54
|
.boolean()
|
|
35
55
|
.optional()
|
|
36
|
-
.
|
|
37
|
-
|
|
56
|
+
.describe("Include dataflow traces for taint analysis findings (--dataflow-traces)"),
|
|
57
|
+
autofix: z.boolean().optional().describe("Automatically apply suggested fixes (--autofix)"),
|
|
58
|
+
dryrun: z
|
|
59
|
+
.boolean()
|
|
60
|
+
.optional()
|
|
61
|
+
.describe("Preview autofix changes without applying them (--dryrun)"),
|
|
62
|
+
maxTargetBytes: z
|
|
63
|
+
.number()
|
|
64
|
+
.optional()
|
|
65
|
+
.describe("Maximum file size in bytes to scan, skip larger files (--max-target-bytes)"),
|
|
66
|
+
jobs: z.number().optional().describe("Number of parallel jobs for scanning (--jobs)"),
|
|
67
|
+
path: z.string().max(INPUT_LIMITS.PATH_MAX).optional().describe("Working directory"),
|
|
68
|
+
compact: z.boolean().optional().default(true).describe("Prefer compact output"),
|
|
38
69
|
},
|
|
39
70
|
outputSchema: SemgrepScanResultSchema,
|
|
40
|
-
}, async ({ patterns, config, severity, path, compact }) => {
|
|
71
|
+
}, async ({ patterns, config, severity, exclude, include, excludeRule, baselineCommit, dataflowTraces, autofix, dryrun, maxTargetBytes, jobs, path, compact, }) => {
|
|
41
72
|
const cwd = path || process.cwd();
|
|
42
73
|
assertAllowedRoot(cwd, "security");
|
|
74
|
+
// Normalize config to array
|
|
75
|
+
const configs = config ? (Array.isArray(config) ? config : [config]) : ["auto"];
|
|
43
76
|
// Validate inputs against flag injection
|
|
44
|
-
|
|
45
|
-
assertNoFlagInjection(
|
|
77
|
+
for (const c of configs) {
|
|
78
|
+
assertNoFlagInjection(c, "config");
|
|
79
|
+
}
|
|
46
80
|
for (const p of patterns) {
|
|
47
81
|
assertNoFlagInjection(p, "patterns");
|
|
48
82
|
}
|
|
83
|
+
for (const e of exclude ?? []) {
|
|
84
|
+
assertNoFlagInjection(e, "exclude");
|
|
85
|
+
}
|
|
86
|
+
for (const i of include ?? []) {
|
|
87
|
+
assertNoFlagInjection(i, "include");
|
|
88
|
+
}
|
|
89
|
+
for (const r of excludeRule ?? []) {
|
|
90
|
+
assertNoFlagInjection(r, "excludeRule");
|
|
91
|
+
}
|
|
92
|
+
if (baselineCommit)
|
|
93
|
+
assertNoFlagInjection(baselineCommit, "baselineCommit");
|
|
49
94
|
const args = ["scan", "--json", "--quiet"];
|
|
50
|
-
|
|
51
|
-
args.push("--config",
|
|
95
|
+
for (const c of configs) {
|
|
96
|
+
args.push("--config", c);
|
|
52
97
|
}
|
|
53
98
|
if (severity) {
|
|
54
99
|
args.push("--severity", severity);
|
|
55
100
|
}
|
|
101
|
+
for (const e of exclude ?? []) {
|
|
102
|
+
args.push("--exclude", e);
|
|
103
|
+
}
|
|
104
|
+
for (const i of include ?? []) {
|
|
105
|
+
args.push("--include", i);
|
|
106
|
+
}
|
|
107
|
+
for (const r of excludeRule ?? []) {
|
|
108
|
+
args.push("--exclude-rule", r);
|
|
109
|
+
}
|
|
110
|
+
if (baselineCommit) {
|
|
111
|
+
args.push("--baseline-commit", baselineCommit);
|
|
112
|
+
}
|
|
113
|
+
if (dataflowTraces) {
|
|
114
|
+
args.push("--dataflow-traces");
|
|
115
|
+
}
|
|
116
|
+
if (autofix) {
|
|
117
|
+
args.push("--autofix");
|
|
118
|
+
}
|
|
119
|
+
if (dryrun) {
|
|
120
|
+
args.push("--dryrun");
|
|
121
|
+
}
|
|
122
|
+
if (maxTargetBytes !== undefined) {
|
|
123
|
+
args.push("--max-target-bytes", String(maxTargetBytes));
|
|
124
|
+
}
|
|
125
|
+
if (jobs !== undefined) {
|
|
126
|
+
args.push("--jobs", String(jobs));
|
|
127
|
+
}
|
|
56
128
|
args.push(...patterns);
|
|
57
129
|
const result = await run("semgrep", args, { cwd, timeout: 300_000 });
|
|
58
|
-
|
|
130
|
+
// Use first config for display; join all for the structured output
|
|
131
|
+
const configDisplay = configs.join(",");
|
|
132
|
+
const data = parseSemgrepJson(result.stdout, configDisplay);
|
|
59
133
|
const rawOutput = (result.stdout + "\n" + result.stderr).trim();
|
|
60
134
|
return compactDualOutput(data, rawOutput, formatSemgrepScan, compactSemgrepScanMap, formatSemgrepScanCompact, compact === false);
|
|
61
135
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,
|
|
1
|
+
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,yHAAyH;QAC3H,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;iBACd,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,MAAM,EAAE,CAAC;iBACN,KAAK,CAAC;gBACL,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;gBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;aACnF,CAAC;iBACD,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CACP,6JAA6J,CAC9J;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACvD,OAAO,EAAE,CAAC;iBACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,oDAAoD,CAAC;YACjE,OAAO,EAAE,CAAC;iBACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,kDAAkD,CAAC;YAC/D,WAAW,EAAE,CAAC;iBACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;iBACpD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,+EAA+E,CAChF;YACH,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,yEAAyE,CAAC;YACtF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAC3F,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,0DAA0D,CAAC;YACvE,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;YACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACpF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SAChF;QACD,YAAY,EAAE,uBAAuB;KACtC,EACD,KAAK,EAAE,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,EACP,WAAW,EACX,cAAc,EACd,cAAc,EACd,OAAO,EACP,MAAM,EACN,cAAc,EACd,IAAI,EACJ,IAAI,EACJ,OAAO,GACR,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,4BAA4B;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,yCAAyC;QACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,qBAAqB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;YAClC,qBAAqB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,cAAc;YAAE,qBAAqB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,mEAAmE;QACnE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAYzE,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA4KlD"}
|
package/dist/tools/trivy.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot, assertNoFlagInjection, } from "@paretools/shared";
|
|
3
3
|
import { parseTrivyJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatTrivyScan, compactTrivyScanMap, formatTrivyScanCompact } from "../lib/formatters.js";
|
|
5
5
|
import { TrivyScanResultSchema } from "../schemas/index.js";
|
|
@@ -7,7 +7,7 @@ import { TrivyScanResultSchema } from "../schemas/index.js";
|
|
|
7
7
|
export function registerTrivyTool(server) {
|
|
8
8
|
server.registerTool("trivy", {
|
|
9
9
|
title: "Trivy Security Scanner",
|
|
10
|
-
description: "Runs Trivy vulnerability/misconfiguration scanner on container images, filesystems, or IaC configs. Returns structured vulnerability data with severity summary.
|
|
10
|
+
description: "Runs Trivy vulnerability/misconfiguration scanner on container images, filesystems, or IaC configs. Returns structured vulnerability data with severity summary.",
|
|
11
11
|
inputSchema: {
|
|
12
12
|
target: z
|
|
13
13
|
.string()
|
|
@@ -17,38 +17,118 @@ export function registerTrivyTool(server) {
|
|
|
17
17
|
.enum(["image", "fs", "config"])
|
|
18
18
|
.optional()
|
|
19
19
|
.default("image")
|
|
20
|
-
.describe(
|
|
20
|
+
.describe("Scan type"),
|
|
21
21
|
severity: z
|
|
22
|
-
.
|
|
22
|
+
.union([
|
|
23
|
+
z.enum(["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]),
|
|
24
|
+
z
|
|
25
|
+
.array(z.enum(["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]))
|
|
26
|
+
.max(INPUT_LIMITS.ARRAY_MAX),
|
|
27
|
+
])
|
|
23
28
|
.optional()
|
|
24
|
-
.describe("Severity filter
|
|
29
|
+
.describe("Severity filter (single value or array)"),
|
|
30
|
+
scanners: z
|
|
31
|
+
.array(z.enum(["vuln", "misconfig", "secret", "license"]))
|
|
32
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
33
|
+
.optional()
|
|
34
|
+
.default([])
|
|
35
|
+
.describe("Scanner types to enable (--scanners)"),
|
|
36
|
+
vulnType: z
|
|
37
|
+
.array(z.enum(["os", "library"]))
|
|
38
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
39
|
+
.optional()
|
|
40
|
+
.default([])
|
|
41
|
+
.describe("Vulnerability types to scan (--vuln-type)"),
|
|
42
|
+
skipDirs: z
|
|
43
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
44
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
45
|
+
.optional()
|
|
46
|
+
.default([])
|
|
47
|
+
.describe("Directories to skip during scanning (--skip-dirs)"),
|
|
48
|
+
skipFiles: z
|
|
49
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
50
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
51
|
+
.optional()
|
|
52
|
+
.default([])
|
|
53
|
+
.describe("Files to skip during scanning (--skip-files)"),
|
|
54
|
+
platform: z
|
|
55
|
+
.string()
|
|
56
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
57
|
+
.optional()
|
|
58
|
+
.describe('Platform for multi-arch image scanning (--platform, e.g., "linux/amd64")'),
|
|
59
|
+
ignorefile: z
|
|
60
|
+
.string()
|
|
61
|
+
.max(INPUT_LIMITS.PATH_MAX)
|
|
62
|
+
.optional()
|
|
63
|
+
.describe("Path to custom .trivyignore file (--ignorefile)"),
|
|
25
64
|
ignoreUnfixed: z
|
|
26
65
|
.boolean()
|
|
27
66
|
.optional()
|
|
28
67
|
.default(false)
|
|
29
68
|
.describe("Only show vulnerabilities with known fixes"),
|
|
30
|
-
|
|
31
|
-
.
|
|
32
|
-
.max(INPUT_LIMITS.PATH_MAX)
|
|
69
|
+
exitCode: z
|
|
70
|
+
.number()
|
|
33
71
|
.optional()
|
|
34
|
-
.describe("
|
|
35
|
-
|
|
72
|
+
.describe("Exit code when vulnerabilities are found (--exit-code)"),
|
|
73
|
+
skipDbUpdate: z
|
|
36
74
|
.boolean()
|
|
37
75
|
.optional()
|
|
38
|
-
.
|
|
39
|
-
|
|
76
|
+
.describe("Skip vulnerability database update for faster scans (--skip-db-update)"),
|
|
77
|
+
path: z.string().max(INPUT_LIMITS.PATH_MAX).optional().describe("Working directory"),
|
|
78
|
+
compact: z.boolean().optional().default(true).describe("Prefer compact output"),
|
|
40
79
|
},
|
|
41
80
|
outputSchema: TrivyScanResultSchema,
|
|
42
|
-
}, async ({ target, scanType, severity, ignoreUnfixed, path, compact }) => {
|
|
81
|
+
}, async ({ target, scanType, severity, scanners, vulnType, skipDirs, skipFiles, platform, ignorefile, ignoreUnfixed, exitCode, skipDbUpdate, path, compact, }) => {
|
|
82
|
+
assertNoFlagInjection(target, "target");
|
|
83
|
+
if (platform)
|
|
84
|
+
assertNoFlagInjection(platform, "platform");
|
|
85
|
+
if (ignorefile)
|
|
86
|
+
assertNoFlagInjection(ignorefile, "ignorefile");
|
|
87
|
+
for (const d of skipDirs ?? []) {
|
|
88
|
+
assertNoFlagInjection(d, "skipDirs");
|
|
89
|
+
}
|
|
90
|
+
for (const f of skipFiles ?? []) {
|
|
91
|
+
assertNoFlagInjection(f, "skipFiles");
|
|
92
|
+
}
|
|
43
93
|
const cwd = path || process.cwd();
|
|
44
94
|
assertAllowedRoot(cwd, "security");
|
|
45
95
|
const args = [scanType, "--format", "json", "--quiet"];
|
|
96
|
+
// Handle severity as single value or CSV array
|
|
46
97
|
if (severity) {
|
|
47
|
-
|
|
98
|
+
const severityStr = Array.isArray(severity) ? severity.join(",") : severity;
|
|
99
|
+
args.push("--severity", severityStr);
|
|
100
|
+
}
|
|
101
|
+
// Scanners (comma-separated)
|
|
102
|
+
if (scanners && scanners.length > 0) {
|
|
103
|
+
args.push("--scanners", scanners.join(","));
|
|
104
|
+
}
|
|
105
|
+
// Vulnerability types (comma-separated)
|
|
106
|
+
if (vulnType && vulnType.length > 0) {
|
|
107
|
+
args.push("--vuln-type", vulnType.join(","));
|
|
108
|
+
}
|
|
109
|
+
// Skip directories
|
|
110
|
+
for (const d of skipDirs ?? []) {
|
|
111
|
+
args.push("--skip-dirs", d);
|
|
112
|
+
}
|
|
113
|
+
// Skip files
|
|
114
|
+
for (const f of skipFiles ?? []) {
|
|
115
|
+
args.push("--skip-files", f);
|
|
116
|
+
}
|
|
117
|
+
if (platform) {
|
|
118
|
+
args.push("--platform", platform);
|
|
119
|
+
}
|
|
120
|
+
if (ignorefile) {
|
|
121
|
+
args.push("--ignorefile", ignorefile);
|
|
48
122
|
}
|
|
49
123
|
if (ignoreUnfixed) {
|
|
50
124
|
args.push("--ignore-unfixed");
|
|
51
125
|
}
|
|
126
|
+
if (exitCode !== undefined) {
|
|
127
|
+
args.push("--exit-code", String(exitCode));
|
|
128
|
+
}
|
|
129
|
+
if (skipDbUpdate) {
|
|
130
|
+
args.push("--skip-db-update");
|
|
131
|
+
}
|
|
52
132
|
args.push(target);
|
|
53
133
|
const result = await run("trivy", args, { cwd, timeout: 300_000 });
|
|
54
134
|
const data = parseTrivyJson(result.stdout, target, scanType);
|
package/dist/tools/trivy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,
|
|
1
|
+
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kKAAkK;QACpK,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC/B,QAAQ,EAAE;iBACV,OAAO,CAAC,OAAO,CAAC;iBAChB,QAAQ,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC;gBACL,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBACxD,CAAC;qBACE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;qBAC/D,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;aAC/B,CAAC;iBACD,QAAQ,EAAE;iBACV,QAAQ,CAAC,yCAAyC,CAAC;YACtD,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;iBACzD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,sCAAsC,CAAC;YACnD,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;iBAChC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,2CAA2C,CAAC;YACxD,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,mDAAmD,CAAC;YAChE,SAAS,EAAE,CAAC;iBACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,CAAC;YACvF,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,4CAA4C,CAAC;YACzD,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,wDAAwD,CAAC;YACrE,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,wEAAwE,CAAC;YACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACpF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SAChF;QACD,YAAY,EAAE,qBAAqB;KACpC,EACD,KAAK,EAAE,EACL,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,UAAU,EACV,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,OAAO,GACR,EAAE,EAAE;QACH,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,UAAU;YAAE,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC/B,qBAAqB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YAChC,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEjE,+CAA+C;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,wCAAwC;QACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,mBAAmB;QACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,aAAa;QACb,KAAK,MAAM,CAAC,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@paretools/security",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.10.0",
|
|
4
4
|
"mcpName": "io.github.Dave-London/pare-security",
|
|
5
5
|
"description": "MCP server for security scanning (Trivy, Semgrep, Gitleaks) with structured, token-efficient output",
|
|
6
6
|
"license": "MIT",
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
"dependencies": {
|
|
58
58
|
"@modelcontextprotocol/sdk": "^1.26.0",
|
|
59
59
|
"zod": "^4.3.6",
|
|
60
|
-
"@paretools/shared": "0.
|
|
60
|
+
"@paretools/shared": "0.10.0"
|
|
61
61
|
},
|
|
62
62
|
"devDependencies": {
|
|
63
63
|
"@types/node": "^25.2.3",
|