@securecode-ai/mcp 0.2.1 → 0.3.1

package/dist/dependency/parsers/requirements.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRequirementsTxt = parseRequirementsTxt;
+exports.normalizePipName = normalizePipName;
+const fs = __importStar(require("fs"));
+/**
+ * Parse a `requirements.txt` file.
+ *
+ * Supported pins:
+ *   name==1.2.3
+ *   name>=1.2.3
+ *   name~=1.2.3
+ *   name>1.0,<2.0
+ *   name (unpinned — marked unresolved)
+ *
+ * `#`-comments, blank lines, `-r other.txt`, `-e .`, and VCS/URL specs are
+ * skipped (URL specs are treated as unpinned/unresolved under the package
+ * name extracted from the URL when possible, otherwise skipped entirely).
+ *
+ * IMPORTANT: no network calls are made. When a pin is not an exact `==`,
+ * the entry is marked `unresolved` and surfaced to the user as such rather
+ * than queried against OSV (since the installed version is unknown). A
+ * Pipfile.lock alongside the requirements.txt will be preferred when
+ * present (handled by the resolver/dependencyChecker, not here).
+ */
+function parseRequirementsTxt(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const manifestPath = lockfilePath; // requirements.txt IS the manifest
+    const packages = [];
+    const seen = new Set();
+    for (const line of raw.split(/\r?\n/)) {
+        let s = line.trim();
+        if (!s)
+            continue;
+        // Strip inline comment.
+        const hash = s.indexOf('#');
+        if (hash >= 0)
+            s = s.slice(0, hash).trim();
+        if (!s)
+            continue;
+        // Skip option lines and recursive includes; we don't follow them.
+        if (s.startsWith('-'))
+            continue;
+        if (s.startsWith('-e ') || s.startsWith('--'))
+            continue;
+        // Skip VCS / URL specs entirely (we cannot resolve them offline).
+        // Examples: git+https://..., https://..., file:///...
+        if (/^[a-z]+(\+[a-z]+)?:\/\//i.test(s))
+            continue;
+        // Strip environment markers: "name==1.0 ; python_version>='3.8'"
+        const semi = s.indexOf(';');
+        if (semi >= 0)
+            s = s.slice(0, semi).trim();
+        if (!s)
+            continue;
+        // Strip extras: "name[extra1,extra2]==1.0"
+        const nameMatch = s.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(\[[^\]]*\])?\s*(.*)$/);
+        if (!nameMatch)
+            continue;
+        const rawName = nameMatch[1];
+        const spec = (nameMatch[3] || '').trim();
+        const name = normalizePipName(rawName);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        // Exact pin: "name==1.2.3"
+        const exact = spec.match(/^==\s*([A-Za-z0-9_.!+*-]+)$/);
+        if (exact) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: exact[1],
+                manifestPath,
+                direct: true,
+            });
+            continue;
+        }
+        // Range pins (>=, >, ~=, <=, <, comma-separated): unresolved.
+        if (spec && /([<>=~!]=?)/.test(spec)) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: spec, // best-effort: keep the spec for display
+                manifestPath,
+                direct: true,
+                unresolved: true,
+            });
+            continue;
+        }
+        // Bare "name" (no pin): unresolved.
+        if (!spec) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: '',
+                manifestPath,
+                direct: true,
+                unresolved: true,
+            });
+            continue;
+        }
+    }
+    return {
+        ecosystem: 'pip',
+        lockfilePath,
+        manifestPath,
+        packages,
+    };
+}
+/** Normalize a PyPI package name per PEP 503 (lowercase, runs of [-_.] -> "-"). */
+function normalizePipName(name) {
+    return name.toLowerCase().replace(/[-_.]+/g, '-');
+}
+//# sourceMappingURL=requirements.js.map

package/dist/dependency/parsers/requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../src/dependency/parsers/requirements.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,oDAyFC;AAGD,4CAEC;AAtHD,uCAAyB;AAIzB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,oBAAoB,CAAC,YAAoB;IACrD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,mCAAmC;IACtE,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,wBAAwB;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,kEAAkE;QAClE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAExD,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAEjD,iEAAiE;QACjE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,2CAA2C;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,2BAA2B;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,YAAY;gBACZ,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,8DAA8D;QAC9D,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,IAAI,EAAE,yCAAyC;gBACxD,YAAY;gBACZ,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,EAAE;gBACX,YAAY;gBACZ,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACb,CAAC;IACL,CAAC;IAED,OAAO;QACH,SAAS,EAAE,KAAK;QAChB,YAAY;QACZ,YAAY;QACZ,QAAQ;KACX,CAAC;AACN,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/dist/dependency/parsers/yarn.d.ts

@@ -0,0 +1,10 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a yarn v1 `yarn.lock` (the classic format). v2+ (Berry) uses a
+ * different text format and is NOT covered here — we deliberately bail in
+ * that case so the caller can skip the file gracefully.
+ *
+ * yarn v1 lockfiles contain the resolved transitive tree: every package
+ * entry has a `version` and a `resolved` URL, including transitive deps.
+ */
+export declare function parseYarnLockfile(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/yarn.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseYarnLockfile = parseYarnLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const lockfile_1 = require("@yarnpkg/lockfile");
+/**
+ * Parse a yarn v1 `yarn.lock` (the classic format). v2+ (Berry) uses a
+ * different text format and is NOT covered here — we deliberately bail in
+ * that case so the caller can skip the file gracefully.
+ *
+ * yarn v1 lockfiles contain the resolved transitive tree: every package
+ * entry has a `version` and a `resolved` URL, including transitive deps.
+ */
+function parseYarnLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    // Detect Yarn Berry (v2+) which uses a different format. The classic
+    // parser will produce garbage on it, so bail.
+    if (raw.includes('__metadata:')) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = (0, lockfile_1.parse)(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || parsed.type !== 'success') {
+        // 'merge' / 'conflict' lockfiles are not directly usable.
+        return null;
+    }
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // optional
+    }
+    // Collect direct dependency names from package.json so we can flag direct vs transitive.
+    const directNames = new Set();
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        for (const k of Object.keys(pkg.dependencies || {}))
+            directNames.add(k);
+        for (const k of Object.keys(pkg.devDependencies || {}))
+            directNames.add(k);
+        for (const k of Object.keys(pkg.optionalDependencies || {}))
+            directNames.add(k);
+    }
+    catch {
+        // optional
+    }
+    const packages = [];
+    const seen = new Set();
+    const obj = parsed.object;
+    for (const [key, entry] of Object.entries(obj)) {
+        // Key looks like "@scope/name@version, @scope/name@npm:^1.2.3, ..."
+        // The actual package name is everything up to the last "@" that
+        // is not part of a scoped leading "@". We pull the canonical name
+        // from the entry itself when possible (yarn exposes `name` only in
+        // some versions), otherwise from the key.
+        const name = extractYarnName(key);
+        const version = entry.version;
+        if (!name || !version)
+            continue;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        packages.push({
+            ecosystem: 'yarn',
+            name,
+            version,
+            manifestPath,
+            direct: directNames.has(name),
+        });
+    }
+    return {
+        ecosystem: 'yarn',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+/**
+ * Extract the package name from a yarn lockfile key.
+ * Examples:
+ *   "lodash@^4.17.19"                       -> "lodash"
+ *   "@babel/core@^7.0.0"                    -> "@babel/core"
+ *   "lodash@npm:^4.17.19, lodash@^4.17.20"  -> "lodash"
+ */
+function extractYarnName(key) {
+    const first = key.split(',')[0].trim();
+    // For scoped: leading "@" then name then "@version"
+    if (first.startsWith('@')) {
+        const at = first.indexOf('@', 1);
+        if (at < 0)
+            return undefined;
+        return first.slice(0, at);
+    }
+    const at = first.indexOf('@');
+    if (at < 0)
+        return undefined;
+    return first.slice(0, at);
+}
+//# sourceMappingURL=yarn.js.map

package/dist/dependency/parsers/yarn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.js","sourceRoot":"","sources":["../../../src/dependency/parsers/yarn.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,8CA+EC;AA5FD,uCAAyB;AACzB,2CAA6B;AAC7B,gDAAiG;AAGjG;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,YAAoB;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAA0E,CAAC;IAC/E,IAAI,CAAC;QACD,MAAM,GAAG,IAAA,gBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACvC,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,yFAAyF;IACzF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,MAA8C,CAAC;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,oEAAoE;QACpE,gEAAgE;QAChE,kEAAkE;QAClE,mEAAmE;QACnE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,MAAM;YACjB,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,oDAAoD;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC"}

package/dist/dependency/resolver.d.ts

@@ -0,0 +1,28 @@
+import { ParsedLockfile, ResolvedPackage } from './types';
+export interface WorkspaceLockfiles {
+    npm: string[];
+    yarn: string[];
+    pnpm: string[];
+    pipenv: string[];
+    pip: string[];
+}
+/**
+ * Walk the workspace looking for known lockfiles. Skips `node_modules`,
+ * `.git`, `.venv`, `venv`, and `dist` to avoid duplicate hits from
+ * vendored deps.
+ */
+export declare function findLockfiles(workspaceRoot: string): WorkspaceLockfiles;
+/** Parse a single lockfile path into a ParsedLockfile (or null). */
+export declare function parseLockfile(lockfilePath: string): ParsedLockfile | null;
+/**
+ * Resolve the full transitive dependency set across all parsed lockfiles.
+ *
+ * The "resolution" is essentially deduplication:
+ *   - Same (ecosystem-family, name, version) seen in two lockfiles is reported once.
+ *   - `family` collapses npm/yarn/pnpm into one (they share the npm registry)
+ *     so a dep found in both package-lock.json and yarn.lock is not queried twice.
+ *   - pip/pipenv are similarly collapsed into one PyPI family.
+ *
+ * Returns the flat list of resolved packages ready for OSV batching.
+ */
+export declare function resolveAll(parsed: ParsedLockfile[]): ResolvedPackage[];

package/dist/dependency/resolver.js

@@ -0,0 +1,159 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findLockfiles = findLockfiles;
+exports.parseLockfile = parseLockfile;
+exports.resolveAll = resolveAll;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const npm_1 = require("./parsers/npm");
+const yarn_1 = require("./parsers/yarn");
+const pnpm_1 = require("./parsers/pnpm");
+const requirements_1 = require("./parsers/requirements");
+const pipfile_1 = require("./parsers/pipfile");
+/**
+ * The "resolver". For npm/yarn/pnpm/Pipfile.lock the lockfile ALREADY contains
+ * the fully-resolved transitive tree, so resolving = walking it (no network).
+ * For requirements.txt with no lockfile, entries are already individual; we
+ * just propagate `unresolved` flags so the checker can surface them instead
+ * of querying OSV with a version we don't actually know.
+ *
+ * This module is also responsible for finding lockfiles in the workspace.
+ */
+const LOCKFILE_NAMES = [
+    { name: 'package-lock.json', ecosystem: 'npm' },
+    { name: 'yarn.lock', ecosystem: 'yarn' },
+    { name: 'pnpm-lock.yaml', ecosystem: 'pnpm' },
+    { name: 'Pipfile.lock', ecosystem: 'pipenv' },
+    { name: 'requirements.txt', ecosystem: 'pip' },
+];
+/**
+ * Walk the workspace looking for known lockfiles. Skips `node_modules`,
+ * `.git`, `.venv`, `venv`, and `dist` to avoid duplicate hits from
+ * vendored deps.
+ */
+function findLockfiles(workspaceRoot) {
+    const out = { npm: [], yarn: [], pnpm: [], pipenv: [], pip: [] };
+    const skip = new Set(['node_modules', '.git', '.venv', 'venv', 'env', 'dist', 'build', '.next', '.turbo']);
+    const walk = (dir, depth) => {
+        if (depth > 8)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (skip.has(e.name))
+                    continue;
+                walk(full, depth + 1);
+            }
+            else if (e.isFile()) {
+                for (const lf of LOCKFILE_NAMES) {
+                    if (e.name === lf.name) {
+                        out[lf.ecosystem].push(full);
+                        break;
+                    }
+                }
+            }
+        }
+    };
+    walk(workspaceRoot, 0);
+    // De-duplicate by directory+ecosystem (a project should only have one
+    // lockfile per ecosystem per folder, but monorepos can have several).
+    const dedup = (arr) => Array.from(new Set(arr));
+    out.npm = dedup(out.npm);
+    out.yarn = dedup(out.yarn);
+    out.pnpm = dedup(out.pnpm);
+    out.pipenv = dedup(out.pipenv);
+    out.pip = dedup(out.pip);
+    return out;
+}
+/** Parse a single lockfile path into a ParsedLockfile (or null). */
+function parseLockfile(lockfilePath) {
+    const base = path.basename(lockfilePath);
+    switch (base) {
+        case 'package-lock.json':
+            return (0, npm_1.parseNpmLockfile)(lockfilePath);
+        case 'yarn.lock':
+            return (0, yarn_1.parseYarnLockfile)(lockfilePath);
+        case 'pnpm-lock.yaml':
+            return (0, pnpm_1.parsePnpmLockfile)(lockfilePath);
+        case 'Pipfile.lock':
+            return (0, pipfile_1.parsePipfileLock)(lockfilePath);
+        case 'requirements.txt':
+            return (0, requirements_1.parseRequirementsTxt)(lockfilePath);
+        default:
+            return null;
+    }
+}
+/**
+ * Resolve the full transitive dependency set across all parsed lockfiles.
+ *
+ * The "resolution" is essentially deduplication:
+ *   - Same (ecosystem-family, name, version) seen in two lockfiles is reported once.
+ *   - `family` collapses npm/yarn/pnpm into one (they share the npm registry)
+ *     so a dep found in both package-lock.json and yarn.lock is not queried twice.
+ *   - pip/pipenv are similarly collapsed into one PyPI family.
+ *
+ * Returns the flat list of resolved packages ready for OSV batching.
+ */
+function resolveAll(parsed) {
+    const familyOf = (e) => e === 'pip' || e === 'pipenv' ? 'pypi' : 'npm';
+    const seen = new Set();
+    const out = [];
+    for (const lf of parsed) {
+        if (!lf)
+            continue;
+        for (const pkg of lf.packages) {
+            // For npm-family, names are case-sensitive on disk but the registry
+            // treats them case-insensitively for lookup; normalize to lower for
+            // dedup so we don't double-query OSV.
+            const fam = familyOf(pkg.ecosystem);
+            const nameKey = fam === 'npm' ? pkg.name : pkg.name.toLowerCase();
+            const id = `${fam}:${nameKey}@${pkg.version || 'unknown'}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            out.push(pkg);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=resolver.js.map

package/dist/dependency/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/dependency/resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,sCAsCC;AAGD,sCAgBC;AAaD,gCAqBC;AAnID,uCAAyB;AACzB,2CAA6B;AAE7B,uCAAiD;AACjD,yCAAmD;AACnD,yCAAmD;AACnD,yDAA8D;AAC9D,+CAAqD;AAErD;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAkD;IAClE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE;IAC/C,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE;IACxC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC7C,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE;CACjD,CAAC;AAUF;;;;GAIG;AACH,SAAgB,aAAa,CAAC,aAAqB;IAC/C,MAAM,GAAG,GAAuB,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE3G,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,EAAE;QACxC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO;QACtB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/B,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1B,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;oBAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;wBACrB,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC7B,MAAM;oBACV,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAEvB,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GAAG,CAAC,GAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,YAAoB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,mBAAmB;YACpB,OAAO,IAAA,sBAAgB,EAAC,YAAY,CAAC,CAAC;QAC1C,KAAK,WAAW;YACZ,OAAO,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QAC3C,KAAK,gBAAgB;YACjB,OAAO,IAAA,wBAAiB,EAAC,YAAY,CAAC,CAAC;QAC3C,KAAK,cAAc;YACf,OAAO,IAAA,0BAAgB,EAAC,YAAY,CAAC,CAAC;QAC1C,KAAK,kBAAkB;YACnB,OAAO,IAAA,mCAAoB,EAAC,YAAY,CAAC,CAAC;QAC9C;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CAAC,MAAwB;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAkB,EAAE,CAC9C,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,oEAAoE;YACpE,oEAAoE;YACpE,sCAAsC;YACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/dependency/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Shared types for the dependency vulnerability checker (Phase 2).
+ *
+ * No source code is ever sent anywhere — only package name + version strings
+ * leave the machine, to OSV.dev (free, no key) and GitHub Advisory REST API
+ * (free, no key for 60 req/hr; 5000 req/hr with optional token). NVD is an
+ * optional CVSS fallback.
+ */
+/** Ecosystems we can parse a lockfile for. */
+export type Ecosystem = 'npm' | 'yarn' | 'pnpm' | 'pip' | 'pipenv';
+/** OSV ecosystem identifier used in OSV.dev API payloads. */
+export type OsvEcosystem = 'npm' | 'PyPI';
+/**
+ * A single resolved dependency as extracted from a lockfile.
+ * For npm/yarn/pnpm this is a transitive entry straight out of the lockfile
+ * (so the resolver does not need to hit the network). For requirements.txt
+ * without a Pipfile.lock, entries may be marked `unresolved` instead of
+ * fetching a registry.
+ */
+export interface ResolvedPackage {
+    ecosystem: Ecosystem;
+    /** Package name as the registry knows it (PyPI names are normalized to lower). */
+    name: string;
+    /** Resolved version (semver for JS, PEP 440-ish for Python). */
+    version: string;
+    /** SPDX license identifier when available from lockfile/metadata, else undefined. */
+    license?: string;
+    /** Path to the manifest this entry came from (for Apply affordance). */
+    manifestPath?: string;
+    /**
+     * True when the version could not be resolved locally (e.g. requirements.txt
+     * pin like `>=1.0` with no lockfile). These are reported as "unresolved"
+     * findings rather than queried against OSV (since we don't know the version).
+     */
+    unresolved?: boolean;
+    /** Direct dependency (declared in manifest) vs transitive (resolved from lockfile). */
+    direct?: boolean;
+}
+/** Output of a lockfile parser. */
+export interface ParsedLockfile {
+    ecosystem: Ecosystem;
+    /** Path to the lockfile that was parsed. */
+    lockfilePath: string;
+    /** Path to the manifest the lockfile corresponds to (package.json, requirements.txt, ...). */
+    manifestPath?: string;
+    /** All resolved packages, direct + transitive. */
+    packages: ResolvedPackage[];
+    /** SPDX license of the project itself, if discoverable (npm package.json `license`). */
+    projectLicense?: string;
+}
+/** An affected version range as returned by OSV / GHSA. */
+export interface AffectedRange {
+    /** OSV ecosystem ('npm' | 'PyPI'). */
+    ecosystem: OsvEcosystem;
+    /** Lower bound of the affected range, inclusive (optional). */
+    introduced?: string;
+    /** Upper bound of the affected range, exclusive (the "first fixed" version). */
+    fixed?: string;
+    /** Raw range string for diagnostics. */
+    raw?: string;
+}
+/** A vulnerability record normalized from OSV / GHSA / NVD. */
+export interface Vulnerability {
+    /** OSV id (OSV-...) or GHSA id (GHSA-...) or CVE id (CVE-...). */
+    id: string;
+    /** Source the record came from. */
+    source: 'osv' | 'ghsa' | 'nvd';
+    /** One-line summary. */
+    summary: string;
+    /** List of affected version ranges. */
+    affected: AffectedRange[];
+    /** CVSS v3 base score 0-10 when known (NVD or OSV severity). */
+    cvssScore?: number;
+    /** URLs for the user to read more. */
+    references?: string[];
+}
+/** A vulnerability matched to a resolved package. */
+export interface MatchedVulnerability {
+    /** The resolved package that is vulnerable. */
+    package: ResolvedPackage;
+    /** Vulnerabilities affecting `package.version`. */
+    vulnerabilities: Vulnerability[];
+    /** Smallest version bump that exits all affected ranges, when computable. */
+    minSafeVersion?: string;
+}

package/dist/dependency/types.js

@@ -0,0 +1,11 @@
+"use strict";
+/**
+ * Shared types for the dependency vulnerability checker (Phase 2).
+ *
+ * No source code is ever sent anywhere — only package name + version strings
+ * leave the machine, to OSV.dev (free, no key) and GitHub Advisory REST API
+ * (free, no key for 60 req/hr; 5000 req/hr with optional token). NVD is an
+ * optional CVSS fallback.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/dependency/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dependency/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/mcp/server.js

@@ -40,6 +40,7 @@ const scan_1 = require("../tools/scan");
 const map_1 = require("../tools/map");
 const fix_1 = require("../tools/fix");
 const attack_1 = require("../tools/attack");
+const scanDependencies_1 = require("../tools/scanDependencies");
 const PROTOCOL_VERSION = '2025-03-26';
 const SERVER_NAME = 'securecode-mcp';
 const SERVER_VERSION = '0.2.0';
@@ -68,6 +69,7 @@ const TOOL_HANDLERS = {
     'securecode.map': map_1.toolMap,
     'securecode.fix': fix_1.toolFix,
     'securecode.attack': attack_1.toolAttack,
+    'securecode.scan-dependencies': scanDependencies_1.toolScanDependencies,
 };
 function validateArgs(tool, args) {
     const schema = tool.inputSchema;