@runsec/mcp 1.0.3 → 1.0.7

package/dist/index.js

@@ -62,10 +62,16 @@ var STANDARD_TOOL_MAP = {
 var cachedRegistry = null;
 var cachedAllRules = null;
 function toSeverity(value) {
-  const normalized = (value || "medium").toLowerCase();
-  if (normalized === "error" || normalized === "critical") return "critical";
-  if (normalized === "warning" || normalized === "high") return "high";
-  if (normalized === "low" || normalized === "info") return "low";
+  const upper = String(value || "").trim().toUpperCase();
+  if (upper === "ERROR" || upper === "CRITICAL") return "critical";
+  if (upper === "WARNING") return "medium";
+  if (upper === "HIGH") return "high";
+  if (upper === "LOW" || upper === "INFO") return "low";
+  const lower = String(value || "medium").toLowerCase();
+  if (lower === "critical" || lower === "error") return "critical";
+  if (lower === "warning") return "medium";
+  if (lower === "high") return "high";
+  if (lower === "low" || lower === "info") return "low";
   return "medium";
 }
 function escapeRegexLiteral(text) {
@@ -117,17 +123,19 @@ function parseSemgrepRuleFiles() {
       const id = String(row.id || "").trim();
       if (!id) continue;
       const message = String(row.message || "").trim();
-      const metricId = extractMetricId(id, message);
+      const descField = String(row.description || "").trim();
+      const metricId = extractMetricId(id, message || descField);
       const map = compliance[metricId] || {};
       const cwe = Array.isArray(map.cwe) && map.cwe.length ? map.cwe[0] : "UNKNOWN";
       const patterns = collectRulePatterns(row);
       if (patterns.length === 0) continue;
+      const description = (message || descField || `RunSec detection ${metricId}`).trim();
       out.push({
         id,
         metricId,
         cwe,
         severity: toSeverity(String(row.severity || "")),
-        description: message || `RunSec detection ${metricId}`,
+        description,
         patterns,
         sourceFile: fileName
       });
@@ -205,7 +213,7 @@ function validateRules() {
   };
   Object.keys(RULES_REGISTRY).forEach((standard) => {
     const count = RULES_REGISTRY[standard].length;
-    console.log(`Loaded ${count} rules for ${standard}`);
+    console.error(`Loaded ${count} rules for ${standard}`);
     if (count <= 0) {
       throw new Error(`Rules pack for ${standard} is empty`);
     }
@@ -326,6 +334,21 @@ function findLineByOffset(content, offset) {
   }
   return line;
 }
+var SNIPPET_MAX_LEN = 150;
+function buildMatchSnippet(content, matchIndex) {
+  const lines = content.split(/\r?\n/);
+  const lineNo1Based = findLineByOffset(content, matchIndex);
+  const lineIdx = lineNo1Based - 1;
+  const parts = [];
+  if (lineIdx > 0) parts.push(lines[lineIdx - 1] ?? "");
+  parts.push(lines[lineIdx] ?? "");
+  if (lineIdx + 1 < lines.length) parts.push(lines[lineIdx + 1] ?? "");
+  let snippet = parts.join("\n");
+  if (snippet.length > SNIPPET_MAX_LEN) {
+    snippet = `${snippet.slice(0, SNIPPET_MAX_LEN - 1)}\u2026`;
+  }
+  return snippet;
+}
 function scanContentWithRules(content, file, workspacePath, rules) {
   const localFindings = [];
   for (const rule of rules) {
@@ -339,6 +362,8 @@ function scanContentWithRules(content, file, workspacePath, rules) {
       let match;
       while ((match = regex.exec(content)) !== null) {
         const line = findLineByOffset(content, match.index);
+        const snippetMatch = match[0] || "";
+        const snippet = buildMatchSnippet(content, match.index);
         localFindings.push({
           rule_id: rule.id,
           cwe: rule.cwe,
@@ -346,7 +371,8 @@ function scanContentWithRules(content, file, workspacePath, rules) {
           description: rule.description,
           file_path: import_node_path2.default.relative(import_node_path2.default.resolve(workspacePath), file).replace(/\\/g, "/"),
           line,
-          match_text: (match[0] || "").slice(0, 200)
+          match_text: snippetMatch.slice(0, 200),
+          snippet
         });
       }
     }
@@ -413,10 +439,19 @@ async function executeAudit(toolName, args) {
 function normalizeSeverity(value) {
   const s = (value || "").toLowerCase();
   if (s === "critical" || s === "error") return "critical";
-  if (s === "high" || s === "warning") return "high";
+  if (s === "high") return "high";
+  if (s === "warning") return "medium";
   if (s === "low" || s === "info") return "low";
   return "medium";
 }
+function fenceLang(filePath) {
+  const ext = (filePath.split(".").pop() || "text").toLowerCase();
+  if (!ext || ext === filePath.toLowerCase()) return "text";
+  return ext.replace(/[^a-z0-9+#-]/gi, "") || "text";
+}
+function snippetForMarkdownFence(snippet) {
+  return snippet.replace(/```/g, "``\\`");
+}
 function safeText(value) {
   return String(value ?? "").replace(/`/g, "'");
 }
@@ -453,7 +488,9 @@ function generateMarkdownReport(standard, findings, metrics) {
   out.push("");
   out.push("---");
   out.push("#### 2. Compliance Matrix");
-  out.push(`- **Critical:** ${critical.length} | **Medium:** ${medium.length} | **Low:** ${low.length}`);
+  out.push(
+    `- **Critical:** ${critical.length} | **High:** ${high.length} | **Medium:** ${medium.length} | **Low:** ${low.length}`
+  );
   out.push(`- **Files Scanned:** ${Number(m.scanned_files_count || 0)} | **Skipped:** ${skippedFiles}`);
   out.push("");
   out.push("---");
@@ -467,8 +504,19 @@ function generateMarkdownReport(standard, findings, metrics) {
       const file = safeText(finding.file_path || "unknown_file");
       const line = Number(finding.line || 0);
       const description = safeText(finding.description || "No description");
+      const sev = safeText((finding.severity || "unknown").toUpperCase());
+      const rawSnippet = String(finding.snippet || finding.match_text || "").trim() || "(no snippet)";
+      const fenced = snippetForMarkdownFence(rawSnippet);
+      const lang = fenceLang(finding.file_path || "");
       out.push(`**[${cwe}] ${rule} in \`${file}:${line}\`**`);
+      out.push(`- **Severity:** ${sev}`);
       out.push(`- **Description:** ${description}`);
+      out.push("> **PoC Snippet:**");
+      out.push(`> \`\`\`${lang}`);
+      for (const ln of fenced.split("\n")) {
+        out.push(`> ${ln}`);
+      }
+      out.push("> ```");
       out.push(
         `- \u{1F4A1} *Prompt to fix:* \`@RunSec Fix the ${rule} vulnerability in ${file}. Ensure it complies with ${safeText(standard)}.\``
       );
@@ -582,7 +630,7 @@ server.setRequestHandler(import_types.CallToolRequestSchema, async (request) =>
 });
 async function main() {
   const summary = validateRules();
-  console.log("Rules registry validated:", summary);
+  console.error("Rules registry validated:", summary);
   const transport = new import_stdio.StdioServerTransport();
   await server.connect(transport);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runsec/mcp",
-  "version": "1.0.3",
+  "version": "1.0.7",
   "main": "dist/index.js",
   "files": [
     "dist",