@runsec/mcp 1.0.12 → 1.0.14

package/dist/index.js

@@ -61,18 +61,53 @@ var STANDARD_TOOL_MAP = {
 };
 var cachedRegistry = null;
 var cachedAllRules = null;
+var CWE_ID_REGEX = /(CWE-\d+)/i;
+function parseCweFromRaw(raw) {
+  if (raw == null) return "UNKNOWN";
+  if (Array.isArray(raw)) {
+    for (const item of raw) {
+      const id = parseCweFromString(String(item));
+      if (id !== "UNKNOWN") return id;
+    }
+    return "UNKNOWN";
+  }
+  return parseCweFromString(String(raw));
+}
+function parseCweFromString(text) {
+  const m = text.match(CWE_ID_REGEX);
+  return m?.[1] ? m[1].toUpperCase() : "UNKNOWN";
+}
+function extractCweFromRule(row, complianceEntry) {
+  const meta = row.metadata;
+  if (meta && typeof meta === "object") {
+    const rawCwe = meta.cwe;
+    const fromMeta = parseCweFromRaw(rawCwe);
+    if (fromMeta !== "UNKNOWN") return fromMeta;
+  }
+  const msg = String(row.message || "").trim();
+  const fromMsg = parseCweFromString(msg);
+  if (fromMsg !== "UNKNOWN") return fromMsg;
+  const desc = String(row.description || "").trim();
+  const fromDesc = parseCweFromString(desc);
+  if (fromDesc !== "UNKNOWN") return fromDesc;
+  if (complianceEntry?.cwe?.length) {
+    const fromMap = parseCweFromString(String(complianceEntry.cwe[0]));
+    if (fromMap !== "UNKNOWN") return fromMap;
+  }
+  return "UNKNOWN";
+}
 function toSeverity(value) {
   const upper = String(value || "").trim().toUpperCase();
   if (upper === "ERROR" || upper === "CRITICAL") return "critical";
-  if (upper === "WARNING") return "medium";
-  if (upper === "HIGH") return "high";
-  if (upper === "LOW" || upper === "INFO") return "low";
-  const lower = String(value || "medium").toLowerCase();
+  if (upper === "WARNING" || upper === "HIGH") return "high";
+  if (upper === "INFO") return "low";
+  if (upper === "LOW") return "low";
+  const lower = String(value || "").toLowerCase();
   if (lower === "critical" || lower === "error") return "critical";
-  if (lower === "warning") return "medium";
-  if (lower === "high") return "high";
-  if (lower === "low" || lower === "info") return "low";
-  return "medium";
+  if (lower === "warning" || lower === "high") return "high";
+  if (lower === "info") return "low";
+  if (lower === "low") return "low";
+  return "high";
 }
 function escapeRegexLiteral(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -123,13 +158,12 @@ function parseSemgrepRuleFiles() {
       const id = String(row.id || "").trim();
       if (!id) continue;
       const message = String(row.message || "").trim();
-      const descField = String(row.description || "").trim();
-      const metricId = extractMetricId(id, message || descField);
+      const metricId = extractMetricId(id, message);
       const map = compliance[metricId] || {};
-      const cwe = Array.isArray(map.cwe) && map.cwe.length ? map.cwe[0] : "UNKNOWN";
+      const cwe = extractCweFromRule(row, map);
       const patterns = collectRulePatterns(row);
       if (patterns.length === 0) continue;
-      const description = (message || descField || `RunSec detection ${metricId}`).trim();
+      const description = message || id;
       out.push({
         id,
         metricId,
@@ -334,20 +368,11 @@ function findLineByOffset(content, offset) {
   }
   return line;
 }
-var SNIPPET_MAX_LEN = 150;
-function buildMatchSnippet(content, matchIndex) {
-  const lines = content.split(/\r?\n/);
-  const lineNo1Based = findLineByOffset(content, matchIndex);
-  const lineIdx = lineNo1Based - 1;
-  const parts = [];
-  if (lineIdx > 0) parts.push(lines[lineIdx - 1] ?? "");
-  parts.push(lines[lineIdx] ?? "");
-  if (lineIdx + 1 < lines.length) parts.push(lines[lineIdx + 1] ?? "");
-  let snippet = parts.join("\n");
-  if (snippet.length > SNIPPET_MAX_LEN) {
-    snippet = `${snippet.slice(0, SNIPPET_MAX_LEN - 1)}\u2026`;
-  }
-  return snippet;
+function extractSnippetByLine(fileContent, line) {
+  const lines = fileContent.split("\n");
+  const start = Math.max(0, line - 2);
+  const end = Math.min(lines.length, line + 1);
+  return lines.slice(start, end).map((l) => l.replace(/\r$/, "")).join("\n").trim();
 }
 function scanContentWithRules(content, file, workspacePath, rules) {
   const localFindings = [];
@@ -363,7 +388,7 @@ function scanContentWithRules(content, file, workspacePath, rules) {
       while ((match = regex.exec(content)) !== null) {
         const line = findLineByOffset(content, match.index);
         const snippetMatch = match[0] || "";
-        const snippet = buildMatchSnippet(content, match.index);
+        const snippet = extractSnippetByLine(content, line);
         localFindings.push({
           rule_id: rule.id,
           cwe: rule.cwe,
@@ -436,13 +461,14 @@ async function executeAudit(toolName, args) {
 }
 
 // src/engine/reportFormatter.ts
-function normalizeSeverity(value) {
+function severityBucket(value) {
   const s = (value || "").toLowerCase();
   if (s === "critical" || s === "error") return "critical";
-  if (s === "high") return "high";
-  if (s === "warning") return "medium";
   if (s === "low" || s === "info") return "low";
-  return "medium";
+  return "high";
+}
+function displaySeverityLabel(value) {
+  return severityBucket(value).toUpperCase();
 }
 function fenceLang(filePath) {
   const ext = (filePath.split(".").pop() || "text").toLowerCase();
@@ -452,6 +478,17 @@ function fenceLang(filePath) {
 function snippetForMarkdownFence(snippet) {
   return snippet.replace(/```/g, "``\\`");
 }
+function appendSnippetBlock(out, finding) {
+  const rawSnippet = String(finding.snippet || finding.match_text || "").trim() || "(no snippet)";
+  const fenced = snippetForMarkdownFence(rawSnippet);
+  const lang = fenceLang(finding.file_path || "");
+  out.push("> **PoC Snippet:**");
+  out.push(`> \`\`\`${lang}`);
+  for (const ln of fenced.split("\n")) {
+    out.push(`> ${ln}`);
+  }
+  out.push("> ```");
+}
 function safeText(value) {
   return String(value ?? "").replace(/`/g, "'");
 }
@@ -469,12 +506,11 @@ You MUST automatically process them and output a final report to the user follow
 function generateMarkdownReport(standard, findings, metrics) {
   const rows = Array.isArray(findings) ? findings : [];
   const m = metrics || {};
-  const critical = rows.filter((f) => normalizeSeverity(f.severity) === "critical");
-  const high = rows.filter((f) => normalizeSeverity(f.severity) === "high");
-  const medium = rows.filter((f) => normalizeSeverity(f.severity) === "medium");
-  const low = rows.filter((f) => normalizeSeverity(f.severity) === "low");
+  const critical = rows.filter((f) => severityBucket(f.severity) === "critical");
+  const high = rows.filter((f) => severityBucket(f.severity) === "high");
+  const low = rows.filter((f) => severityBucket(f.severity) === "low");
   const severe = [...critical, ...high];
-  const soft = [...medium, ...low];
+  const soft = [...low];
   const cweCounts = m.cwe_counts || {};
   const skippedFiles = Number(m.skipped_files || 0);
   const telemetry = {
@@ -500,7 +536,7 @@ function generateMarkdownReport(standard, findings, metrics) {
   out.push("---");
   out.push("#### 2. Compliance Matrix");
   out.push(
-    `- **Critical:** ${critical.length} | **High:** ${high.length} | **Medium:** ${medium.length} | **Low:** ${low.length}`
+    `- **CRITICAL:** ${critical.length} | **HIGH:** ${high.length} | **LOW:** ${low.length}`
   );
   out.push(`- **Files Scanned:** ${Number(m.scanned_files_count || 0)} | **Skipped:** ${skippedFiles}`);
   out.push("- **\u{1F6E1}\uFE0F False Positives Dropped by AI:** [Count] *(LLM: replace [Count] after triage; keep this line in the Compliance Matrix.)*");
@@ -516,19 +552,11 @@ function generateMarkdownReport(standard, findings, metrics) {
       const file = safeText(finding.file_path || "unknown_file");
       const line = Number(finding.line || 0);
       const description = safeText(finding.description || "No description");
-      const sev = safeText((finding.severity || "unknown").toUpperCase());
-      const rawSnippet = String(finding.snippet || finding.match_text || "").trim() || "(no snippet)";
-      const fenced = snippetForMarkdownFence(rawSnippet);
-      const lang = fenceLang(finding.file_path || "");
+      const sev = displaySeverityLabel(finding.severity);
       out.push(`**[${cwe}] ${rule} in \`${file}:${line}\`**`);
       out.push(`- **Severity:** ${sev}`);
       out.push(`- **Description:** ${description}`);
-      out.push("> **PoC Snippet:**");
-      out.push(`> \`\`\`${lang}`);
-      for (const ln of fenced.split("\n")) {
-        out.push(`> ${ln}`);
-      }
-      out.push("> ```");
+      appendSnippetBlock(out, finding);
       out.push(
         `- \u{1F4A1} *Prompt to fix:* \`@RunSec Fix the ${rule} vulnerability in ${file}. Ensure it complies with ${safeText(standard)}.\``
       );
@@ -536,23 +564,28 @@ function generateMarkdownReport(standard, findings, metrics) {
     }
   }
   out.push("---");
-  out.push("#### 4. Medium & Low Risks");
+  out.push("#### 4. LOW severity findings");
   if (soft.length === 0) {
-    out.push("_No medium or low risks detected._");
+    out.push("_No LOW / INFO severity findings in this bucket._");
   } else {
     for (const finding of soft) {
-      out.push(
-        `- \`${safeText(finding.file_path || "unknown_file")}:${Number(finding.line || 0)}\` ${safeText(
-          finding.rule_id || "unknown_rule"
-        )}`
-      );
+      const cwe = safeText(finding.cwe || "UNKNOWN");
+      const rule = safeText(finding.rule_id || "unknown_rule");
+      const file = safeText(finding.file_path || "unknown_file");
+      const line = Number(finding.line || 0);
+      const description = safeText(finding.description || "No description");
+      out.push(`**[${cwe}] ${rule} in \`${file}:${line}\`**`);
+      out.push(`- **Severity:** ${displaySeverityLabel(finding.severity)}`);
+      out.push(`- **Description:** ${description}`);
+      appendSnippetBlock(out, finding);
+      out.push("");
     }
   }
   out.push("");
   out.push("---");
   out.push("#### 5. Remediation Roadmap");
   out.push('- **Iteration 1 (Immediate):** Copy the "Prompt to fix" commands above for Critical issues.');
-  out.push("- **Iteration 2:** Review and address Medium risks.");
+  out.push("- **Iteration 2:** Review and address LOW / INFO findings.");
   out.push("");
   out.push("<details>");
   out.push("<summary>System Telemetry</summary>");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runsec/mcp",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "main": "dist/index.js",
   "files": [
     "dist",