@runsec/mcp 1.0.82 → 1.0.84

package/bin/runsec-mcp.cjs

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 "use strict";
 
 const fs = require("node:fs");

package/dist/index.js

@@ -1239,7 +1239,6 @@ function applyCognitivePipeline(workspaceRoot, findings) {
       (f) => f.suppressed || isNuclearSuppressedFinding(f) || !f.primary_log_eligible
     )
   ).concat(duplicates);
-  const allScored = [...primary, ...suppressed];
   console.error(
     `[runsec] cognitive: raw=${findings.length} nuclear=${nuclearSuppressed.length} primary=${primary.length} suppressed=${suppressed.length}`
   );
@@ -1249,7 +1248,7 @@ function applyCognitivePipeline(workspaceRoot, findings) {
     summary: {
       version: "v1.0",
       primary_log_threshold: PRIMARY_LOG_THRESHOLD,
-      findings_total: allScored.length,
+      findings_total: findings.length,
       findings_primary: primary.length,
       findings_suppressed: suppressed.length,
       false_positive_filtering: true
@@ -1871,14 +1870,6 @@ function mapTrufflehogFindings(rows, workspaceRoot) {
     const rawSecret = String(raw.Raw ?? "").trim();
     const display = redacted || rawSecret || "[secret redacted]";
     const description = `TruffleHog: exposed ${detector}${verified ? " (verified)" : ""}`;
-    if (!isTrufflehogVerified(verified, description)) {
-      const blob = `${display} ${rawSecret} ${description}`;
-      if (isLockfileOrModulesPath(rel) || isStaticLayoutDumpPath(rel)) continue;
-      if (hasEnvironmentInterpolation(blob)) continue;
-      if (blobHasDevDatabaseSecret(blob)) continue;
-      if (isHexChecksumBlob(display) || isHexChecksumBlob(rawSecret)) continue;
-      if (isUnverifiedTrufflehogNoiseDetector(detector)) continue;
-    }
     const severity = severityForSecret(detector, verified);
     findings.push({
       category: "secrets",
@@ -2576,16 +2567,11 @@ var import_promises = __toESM(require("fs/promises"));
 var import_node_os = __toESM(require("os"));
 var import_node_path11 = __toESM(require("path"));
 var TRUFFLEHOG_EXCLUDE_PATTERNS = [
-  "**/*.lock",
-  "**/package-lock.json",
-  "**/pnpm-lock.yaml",
-  "**/yarn.lock",
-  "**/poetry.lock",
-  "**/Cargo.lock",
-  "**/composer.lock",
-  "**/Gemfile.lock",
-  "**/*-lock.json",
-  "**/node_modules/**"
+  String.raw`\.lock$`,
+  String.raw`package-lock\.json$`,
+  String.raw`pnpm-lock\.yaml$`,
+  String.raw`-lock\.json$`,
+  String.raw`(^|[\\/])node_modules([\\/]|$)`
 ];
 async function createTrufflehogExcludeFile() {
   const tmpDir = await import_promises.default.mkdtemp(import_node_path11.default.join(import_node_os.default.tmpdir(), "runsec-th-exclude-"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runsec/mcp",
-  "version": "1.0.82",
+  "version": "1.0.84",
   "main": "dist/index.js",
   "files": [
     "package.json",