@securecode-ai/mcp 0.3.9 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/types.d.ts +18 -0
- package/dist/tools/agentScan.d.ts +8 -7
- package/dist/tools/agentScan.js +64 -15
- package/dist/tools/agentScan.js.map +1 -1
- package/package.json +1 -1
package/dist/api/types.d.ts
CHANGED
|
@@ -167,3 +167,21 @@ export interface ProjectMap {
|
|
|
167
167
|
builtAt?: string;
|
|
168
168
|
version?: number;
|
|
169
169
|
}
|
|
170
|
+
export interface SandboxProveResponse {
|
|
171
|
+
proven: 'PROVEN' | 'UNPROVEN' | 'INCONCLUSIVE' | 'NOT_REPRODUCIBLE';
|
|
172
|
+
canReproduce: boolean;
|
|
173
|
+
skipReason?: string;
|
|
174
|
+
rationale?: string;
|
|
175
|
+
degraded: boolean;
|
|
176
|
+
sandbox?: {
|
|
177
|
+
verdict: string;
|
|
178
|
+
rule: string;
|
|
179
|
+
reason: string;
|
|
180
|
+
serverBooted: boolean;
|
|
181
|
+
port: number;
|
|
182
|
+
elapsedMs: number;
|
|
183
|
+
baselineStatus?: number;
|
|
184
|
+
exploitStatus?: number;
|
|
185
|
+
};
|
|
186
|
+
scanCredits?: number;
|
|
187
|
+
}
|
|
@@ -1,19 +1,20 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* securecode.agent-scan MCP tool — agent-mode scan.
|
|
2
|
+
* securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
|
|
3
3
|
*
|
|
4
4
|
* An AI investigator that reads files, traces data flows, checks guards,
|
|
5
|
-
* and compares endpoint policies to find vulnerabilities.
|
|
6
|
-
*
|
|
7
|
-
*
|
|
5
|
+
* and compares endpoint policies to find vulnerabilities. Each high/critical
|
|
6
|
+
* finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
|
|
7
|
+
* the Juror confirms it.
|
|
8
8
|
*
|
|
9
9
|
* Flow:
|
|
10
10
|
* 1. Resolve code + language from filePath
|
|
11
11
|
* 2. Build endpoint context from the project map
|
|
12
12
|
* 3. Run the agent loop (POST /agent/scan/start + /step loop)
|
|
13
|
-
* 4.
|
|
14
|
-
* 5.
|
|
13
|
+
* 4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
|
|
14
|
+
* 5. Map agent findings → CandidateContext[]
|
|
15
|
+
* 6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
|
|
15
16
|
* Juror + Phase 3 verify the agent's candidates)
|
|
16
|
-
*
|
|
17
|
+
* 7. Return merged result (agent findings + proven stamps + Juror-verified)
|
|
17
18
|
*/
|
|
18
19
|
import type { ServerContext } from '../mcp/types';
|
|
19
20
|
export declare function toolAgentScan(ctx: ServerContext, args: any): Promise<unknown>;
|
package/dist/tools/agentScan.js
CHANGED
|
@@ -1,20 +1,21 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
/**
|
|
3
|
-
* securecode.agent-scan MCP tool — agent-mode scan.
|
|
3
|
+
* securecode.agent-scan MCP tool — agent-mode scan with exploit proof.
|
|
4
4
|
*
|
|
5
5
|
* An AI investigator that reads files, traces data flows, checks guards,
|
|
6
|
-
* and compares endpoint policies to find vulnerabilities.
|
|
7
|
-
*
|
|
8
|
-
*
|
|
6
|
+
* and compares endpoint policies to find vulnerabilities. Each high/critical
|
|
7
|
+
* finding is then sent to the sandbox for PROVEN/UNPROVEN verification before
|
|
8
|
+
* the Juror confirms it.
|
|
9
9
|
*
|
|
10
10
|
* Flow:
|
|
11
11
|
* 1. Resolve code + language from filePath
|
|
12
12
|
* 2. Build endpoint context from the project map
|
|
13
13
|
* 3. Run the agent loop (POST /agent/scan/start + /step loop)
|
|
14
|
-
* 4.
|
|
15
|
-
* 5.
|
|
14
|
+
* 4. For each high/critical finding → POST /sandbox/prove → PROVEN/UNPROVEN
|
|
15
|
+
* 5. Map agent findings → CandidateContext[]
|
|
16
|
+
* 6. POST /scan with scanDepth: 'agent' + candidateContexts (skips Scout,
|
|
16
17
|
* Juror + Phase 3 verify the agent's candidates)
|
|
17
|
-
*
|
|
18
|
+
* 7. Return merged result (agent findings + proven stamps + Juror-verified)
|
|
18
19
|
*/
|
|
19
20
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
20
21
|
exports.toolAgentScan = toolAgentScan;
|
|
@@ -31,6 +32,10 @@ function mapFindingsToCandidates(findings) {
|
|
|
31
32
|
definitionContext: f.why,
|
|
32
33
|
}));
|
|
33
34
|
}
|
|
35
|
+
/** Only prove high/critical findings — don't waste credits on low/medium. */
|
|
36
|
+
function shouldProve(finding) {
|
|
37
|
+
return finding.severity === 'critical' || finding.severity === 'high';
|
|
38
|
+
}
|
|
34
39
|
async function toolAgentScan(ctx, args) {
|
|
35
40
|
const progress = args._progress;
|
|
36
41
|
// 1. Resolve code + language
|
|
@@ -76,24 +81,65 @@ async function toolAgentScan(ctx, args) {
|
|
|
76
81
|
if (agentResult.status === 'spawn_failed') {
|
|
77
82
|
throw new Error(agentResult.error || 'Agent scan failed to start.');
|
|
78
83
|
}
|
|
79
|
-
// 4.
|
|
80
|
-
const
|
|
81
|
-
|
|
84
|
+
// 4. Prove each high/critical finding via the sandbox
|
|
85
|
+
const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
|
|
86
|
+
const provenFindings = [];
|
|
87
|
+
const proveable = agentResult.findings.filter(shouldProve);
|
|
88
|
+
if (proveable.length > 0 && progress) {
|
|
89
|
+
progress(0, proveable.length, `Proving ${proveable.length} finding(s) in sandbox...`);
|
|
90
|
+
}
|
|
91
|
+
let proveIdx = 0;
|
|
92
|
+
for (const finding of agentResult.findings) {
|
|
93
|
+
if (!shouldProve(finding)) {
|
|
94
|
+
provenFindings.push({ ...finding, proven: 'SKIPPED', provenReason: 'Low/medium severity — not proven' });
|
|
95
|
+
continue;
|
|
96
|
+
}
|
|
97
|
+
try {
|
|
98
|
+
if (progress) {
|
|
99
|
+
proveIdx++;
|
|
100
|
+
progress(proveIdx, proveable.length, `Proving ${finding.type} at line ${finding.line}...`);
|
|
101
|
+
}
|
|
102
|
+
const proveResp = await client.postJson('/sandbox/prove', {
|
|
103
|
+
code,
|
|
104
|
+
language,
|
|
105
|
+
vulnerabilityType: finding.type,
|
|
106
|
+
line: finding.line,
|
|
107
|
+
lineEnd: finding.lineEnd,
|
|
108
|
+
evidence: finding.evidence,
|
|
109
|
+
why: finding.why,
|
|
110
|
+
});
|
|
111
|
+
provenFindings.push({
|
|
112
|
+
...finding,
|
|
113
|
+
proven: proveResp.proven,
|
|
114
|
+
provenReason: proveResp.rationale || proveResp.skipReason || proveResp.sandbox?.reason,
|
|
115
|
+
});
|
|
116
|
+
}
|
|
117
|
+
catch (err) {
|
|
118
|
+
// Insufficient credits or API error — skip proving, mark as INCONCLUSIVE
|
|
119
|
+
provenFindings.push({
|
|
120
|
+
...finding,
|
|
121
|
+
proven: 'INCONCLUSIVE',
|
|
122
|
+
provenReason: `Sandbox prove failed: ${err.message || err}`,
|
|
123
|
+
});
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
// 5. Map findings → CandidateContext[]
|
|
127
|
+
const candidateContexts = mapFindingsToCandidates(provenFindings);
|
|
128
|
+
// 6. If no findings, return early
|
|
82
129
|
if (candidateContexts.length === 0) {
|
|
83
130
|
return {
|
|
84
131
|
status: agentResult.status,
|
|
85
132
|
summary: agentResult.summary || 'Agent completed with no findings.',
|
|
86
133
|
findings: [],
|
|
87
|
-
agentFindings:
|
|
134
|
+
agentFindings: provenFindings,
|
|
88
135
|
stepsUsed: agentResult.stepsUsed,
|
|
89
136
|
costSpentUsd: agentResult.costSpentUsd,
|
|
90
137
|
transcript: agentResult.transcript,
|
|
91
138
|
};
|
|
92
139
|
}
|
|
93
|
-
//
|
|
140
|
+
// 7. POST /scan with scanDepth: 'agent' + candidateContexts
|
|
94
141
|
// This skips Scout and sends the agent's candidates directly to Juror
|
|
95
142
|
// + Phase 3 for verification.
|
|
96
|
-
const client = new client_1.ApiClient({ baseUrl: ctx.apiUrl, token: ctx.apiToken });
|
|
97
143
|
const scanResp = await client.postJson('/scan', {
|
|
98
144
|
code,
|
|
99
145
|
language,
|
|
@@ -102,11 +148,11 @@ async function toolAgentScan(ctx, args) {
|
|
|
102
148
|
candidateContexts,
|
|
103
149
|
...(endpointContext.length > 0 ? { endpointContext } : {}),
|
|
104
150
|
});
|
|
105
|
-
//
|
|
151
|
+
// 8. Return merged result with proven stamps
|
|
106
152
|
return {
|
|
107
153
|
status: agentResult.status,
|
|
108
154
|
summary: agentResult.summary,
|
|
109
|
-
agentFindings:
|
|
155
|
+
agentFindings: provenFindings,
|
|
110
156
|
verifiedFindings: scanResp.finalFindings || [],
|
|
111
157
|
allFindings: scanResp.findings || [],
|
|
112
158
|
scanId: scanResp.scanId,
|
|
@@ -117,6 +163,9 @@ async function toolAgentScan(ctx, args) {
|
|
|
117
163
|
stepsUsed: agentResult.stepsUsed,
|
|
118
164
|
costSpentUsd: agentResult.costSpentUsd,
|
|
119
165
|
transcript: agentResult.transcript,
|
|
166
|
+
provenCount: provenFindings.filter(f => f.proven === 'PROVEN').length,
|
|
167
|
+
unprovenCount: provenFindings.filter(f => f.proven === 'UNPROVEN').length,
|
|
168
|
+
inconclusiveCount: provenFindings.filter(f => f.proven === 'INCONCLUSIVE').length,
|
|
120
169
|
};
|
|
121
170
|
}
|
|
122
171
|
//# sourceMappingURL=agentScan.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agentScan.js","sourceRoot":"","sources":["../../src/tools/agentScan.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"agentScan.js","sourceRoot":"","sources":["../../src/tools/agentScan.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAsCH,sCA8IC;AAlLD,0CAA0C;AAE1C,0CAAuD;AACvD,0DAAsE;AACtE,2DAAuD;AAiBvD,SAAS,uBAAuB,CAAC,QAAyB;IACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,iBAAiB,EAAE,CAAC,CAAC,GAAG;KAC3B,CAAC,CAAC,CAAC;AACR,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAyB;IAC1C,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,GAAkB,EAAE,IAAS;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAqF,CAAC;IAE5G,6BAA6B;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,QAA4B,CAAC;IAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,MAAM,UAAU,GAAG,IAAA,6BAAqB,EAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC7C,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,IAAI,eAAe,GAAU,EAAE,CAAC;IAChC,IAAI,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC;YACD,eAAe,GAAG,MAAM,IAAA,sCAAyB,EAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACL,iDAAiD;QACrD,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,MAAM,MAAM,GAAoB;QAC5B,QAAQ,EAAE,QAAQ,IAAI,aAAa;QACnC,QAAQ;QACR,WAAW,EAAE,IAAI;QACjB,eAAe;KAClB,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAY,EAAC,GAAG,EAAE,MAAM,EAAE;QAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,QAAQ;gBAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;KACJ,CAAC,CAAC;IAEH,IAAI,WAAW,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,SAAS,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACzG,SAAS;QACb,CAAC;QAED,IAAI,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,CAAC;gBACX,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;YAC/F,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAuB,gBAAgB,EAAE;gBAC5E,IAAI;gBACJ,QAAQ;gBACR,iBAAiB,EAAE,OAAO,CAAC,IAAI;gBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACnB,CAAC,CAAC;YAEH,cAAc,CAAC,IAAI,CAAC;gBAChB,GAAG,OAAO;gBACV,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,YAAY,EAAE,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM;aACzF,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,yEAAyE;YACzE,cAAc,CAAC,IAAI,CAAC;gBAChB,GAAG,OAAO;gBACV,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,yBAAyB,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE;aAC9D,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAElE,kCAAkC;IAClC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,mCAAmC;YACnE,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,cAAc;YAC7B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,UAAU,EAAE,WAAW,CAAC,UAAU;SACrC,CAAC;IACN,CAAC;IAED,4DAA4D;IAC5D,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAe,OAAO,EAAE;QAC1D,IAAI;QACJ,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,SAAS,EAAE,OAAO;QAClB,iBAAiB;QACjB,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IAEH,6CAA6C;IAC7C,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;QAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;QACrE,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QACzE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;KACpF,CAAC;AACN,CAAC"}
|
package/package.json
CHANGED