@topy-ai/maggie 0.7.60 → 0.8.0

package/bundled-tools/clis/maggie_security_report.py

@@ -161,6 +161,32 @@ def why(finding: dict) -> str:
     return f"{severity} known flaw (CVE) affects the version you run."
 
 
+# SSVC (CISA Stakeholder-Specific Vulnerability Categorization) gives each finding a
+# defensible "do it now vs watch it" decision from signals we already have, rather
+# than a bare severity number. A faithful simplification of the deployer tree:
+# Exploitation (KEV→active, EPSS→likely) × Automatable (EPSS/critical) × Impact (severity).
+SSVC_HELP = {"Act": "fix now", "Attend": "fix soon (this cycle)", "Track*": "watch closely", "Track": "routine"}
+
+
+def ssvc_decision(finding: dict) -> dict:
+    kev = bool((finding.get("kev") or {}).get("listed"))
+    epss = (finding.get("epss") or {}).get("score") or 0
+    severity = finding.get("severity", "medium")
+    exploitation = "active" if kev else ("likely" if epss >= 0.1 else "none")
+    high_impact = severity in ("critical", "high")
+    automatable = epss >= 0.1 or severity == "critical"
+    if exploitation == "active":
+        decision = "Act" if high_impact else "Attend"
+    elif automatable and high_impact:
+        decision = "Attend"
+    elif high_impact or automatable:
+        decision = "Track*"
+    else:
+        decision = "Track"
+    return {"decision": decision, "exploitation": exploitation,
+            "automatable": bool(automatable), "impact": "high" if high_impact else "partial"}
+
+
 def how(finding: dict) -> str:
     steps = (finding.get("remediation") or {}).get("steps") or []
     step = next((s for s in steps if not s.startswith("Listed by CISA")), None)
@@ -298,7 +324,8 @@ def build(ctx: core.Context) -> dict:
         "verdict": verdict_info,
         "counts": {"new": sum(1 for f in findings if f["status"] == "new"), "open": sum(1 for f in findings if f["status"] == "open"),
                    "fixed": len(fixed_ids), "by_priority": {p: sum(1 for f in actionable if f["priority"] == p) for p in core.PRIORITIES}},
-        "actions": [{"finding_id": a["ids"][0], "finding_ids": a["ids"], "priority": a["priority"], "title": a["title"]}
+        "actions": [{"finding_id": a["ids"][0], "finding_ids": a["ids"], "priority": a["priority"], "title": a["title"],
+                     "ssvc": ssvc_decision(a["lead"])["decision"]}
                     for a in group_actions(actions)[:5]],
         "coverage": None,
         "checked": checked, "not_checked": missing, "degraded_sources": degraded,
@@ -401,10 +428,12 @@ def render(data: dict, findings: list[dict], audience: str, site: str, clip: boo
         lines.append(f"   How: {action['how']}")
         if not owner:
             lead = action["lead"]
+            ssvc = ssvc_decision(lead)
             lines.append(f"   {action['count']} finding(s): " + ", ".join(f"`{i}`" for i in action["ids"][:6])
                          + (" …" if len(action["ids"]) > 6 else "") + f" · {', '.join((lead.get('aliases') or [])[:3])}"
                          + (f" · CVSS {lead['cvss']['score']}" if lead.get("cvss") else "")
-                         + (f" · EPSS {lead['epss']['score']:.2f}" if lead.get("epss") else ""))
+                         + (f" · EPSS {lead['epss']['score']:.2f}" if lead.get("epss") else "")
+                         + f" · SSVC {ssvc['decision']} ({SSVC_HELP[ssvc['decision']]})")
     if len(urgent_actions) > 5:
         lines.append(f"\n…and {len(urgent_actions) - 5} more below.")
     lines.append("")
@@ -547,6 +576,53 @@ def fix_category(finding: dict) -> str:
     return "other"
 
 
+# Fix-risk tiers answer "will this patch break something?", a separate axis from
+# "how urgent is the flaw?" (severity/KEV/EPSS). The operator uses both: a KEV
+# critical justifies a riskier tier sooner, but the tier decides HOW to apply it.
+FIX_TIERS = [
+    ("T1", "Safe to batch-apply",
+     "Distro security-only updates and file-permission fixes. ABI-stable within the release; very low breakage risk. Do these first."),
+    ("T2", "Apply, then restart and smoke-test",
+     "App package upgrades (no major-version change) and plan-only setups. Low–moderate risk: restart the affected service and check it serves."),
+    ("T3", "Apply one at a time — validate and auto-rollback",
+     "Config hardening (TLS, headers, firewall, vhosts). Changes behaviour; can break old clients or lock you out. Each step backs up, validates, and reverts on failure."),
+    ("T4", "Do NOT auto-apply — stage first",
+     "Major-version jumps and end-of-life moves. High compatibility risk. Test in staging, schedule a change window; record as accepted-risk until then."),
+]
+TIER_LABEL = {t: f"{t} — {name}" for t, name, _ in FIX_TIERS}
+TIER_ORDER = [t for t, _, _ in FIX_TIERS]
+
+
+def _is_major_jump(current: str | None, fixed: str | None) -> bool:
+    """A different leading integer between the installed and fixed version — the
+    semver signal for a breaking upgrade (nginx 1.x→2.x, OpenSSL 1.1→3.0, Node 18→22)."""
+    def major(v: str | None) -> str | None:
+        m = re.match(r"\D*(\d+)", v or "")
+        return m.group(1) if m else None
+    cm, fm = major(current), major(fixed)
+    return bool(cm and fm and cm != fm)
+
+
+def fix_tier(action: dict) -> str:
+    """Compatibility/reversibility tier T1–T4 for an action (see FIX_TIERS)."""
+    lead = action["lead"]
+    category = fix_category(lead)
+    if category == "end-of-life":
+        return "T4"
+    if category == "packages":
+        osfam = (action.get("ecosystem") or "").split(":")[0]
+        if osfam in ("Ubuntu", "Debian"):
+            return "T1"  # distro security pocket, ABI-stable within the release
+        if _is_major_jump((lead.get("affected") or {}).get("version"), action.get("fix_version")):
+            return "T4"  # app package with a breaking major-version jump
+        return "T2"
+    if category == "secrets-permissions":
+        return "T1"
+    if category in ("web-server", "firewall"):
+        return "T3"  # config change that alters behaviour / can lock you out
+    return "T2"
+
+
 def fix_commands(action: dict) -> tuple[list[str], list[tuple[str, str]], list[str]]:
     """(shell commands, (kind, snippet) paste-ins, TODO notes) faithfully from the lead finding."""
     lead = action["lead"]
@@ -623,6 +699,33 @@ def nginx_fix_block(actions: list[dict]) -> tuple[list[str], list[str]]:
     return sh, md
 
 
+def impact_summary_sh(impact: dict) -> list[str]:
+    """A blast-radius header for the runbook, from `host-impact`'s snapshot."""
+    svcs = impact.get("services_need_restart") or []
+    listening = impact.get("listening") or []
+    out = ["# =================== Blast radius (from host-impact) ===================",
+           f"# Pending updates: {len(impact.get('pending_updates') or [])} "
+           f"({len(impact.get('security_updates') or [])} security-only — safe to batch as T1).",
+           f"# Public-facing services (port -> process): "
+           + (", ".join(f"{l['port']}:{l['process']}" for l in listening[:8]) or "none detected") + ".",
+           f"# Needs restart after patching ({len(svcs)}): " + (", ".join(svcs[:8]) or "none") + ".",
+           f"# Reboot pending: {'YES — schedule a maintenance window' if impact.get('reboot_required') else 'no'}.",
+           "# A patch is not live in a running service until that service restarts (or the box reboots).", ""]
+    return out
+
+
+def impact_summary_md(impact: dict) -> list[str]:
+    svcs = impact.get("services_need_restart") or []
+    listening = impact.get("listening") or []
+    return ["## Blast radius (from `host-impact`)", "",
+            f"- **Pending updates:** {len(impact.get('pending_updates') or [])} "
+            f"({len(impact.get('security_updates') or [])} security-only → safe to batch as T1)",
+            "- **Public-facing services:** " + (", ".join(f"`{l['port']}:{l['process']}`" for l in listening[:8]) or "none detected"),
+            f"- **Needs restart after patching ({len(svcs)}):** " + (", ".join(f"`{s}`" for s in svcs[:8]) or "none"),
+            f"- **Reboot pending:** {'**YES** — schedule a maintenance window' if impact.get('reboot_required') else 'no'}",
+            "", "_A patch is not live in a running service until that service restarts (or the box reboots)._", ""]
+
+
 def fix_plan(ctx: core.Context) -> dict:
     args = ctx.args
     since = resolve_since(ctx, args.since)
@@ -636,6 +739,9 @@ def fix_plan(ctx: core.Context) -> dict:
     for action in actions:
         buckets[fix_category(action["lead"])].append(action)
 
+    impact_path = ctx.state.path("inventory", "impact.json")
+    impact = core.read_json(impact_path) if impact_path.is_file() else None
+
     host = next((f.get("target", {}).get("host") for f in actionable if (f.get("target") or {}).get("host")), None)
     lock_target = host or "<user@host>"
     sh: list[str] = [
@@ -648,15 +754,36 @@ def fix_plan(ctx: core.Context) -> dict:
         "#   2. opening a SECOND SSH session (so a bad sshd/firewall change cannot lock you out),",
         f"#   3. taking the change lock: maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan",
         "# Package upgrades belong in a maintenance window. Test nginx with `nginx -t` before every reload.",
+        "#",
+        "# FIX-RISK TIERS (will this patch break something? — separate from how urgent the flaw is):",
+    ] + [f"#   {TIER_LABEL[t]}: {note}" for t, _, note in FIX_TIERS] + [
+        "# Recommended order: T1 first, then T2, then T3 one at a time; schedule T4 separately.",
         "set -euo pipefail",
         "",
     ]
     md: list[str] = [f"# Remediation runbook — {ctx.site}" + (f" ({host})" if host else ""), "",
                      "Generated by `maggie security fix-plan`. **Review before running — Maggie never runs these.** "
                      "Take a backup, keep a second SSH session open, and work under "
-                     f"`maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan`.", ""]
+                     f"`maggie deployment host-lock acquire --host {lock_target} --purpose fix-plan`.", "",
+                     "**Fix-risk tiers** — how likely a patch is to break something (separate from how urgent the flaw is). "
+                     "Apply T1 first, then T2, then T3 one at a time; schedule T4 separately.", ""]
+    md += [f"- **{TIER_LABEL[t]}** — {note}" for t, _, note in FIX_TIERS] + [""]
+    if impact:
+        sh += impact_summary_sh(impact)
+        md += impact_summary_md(impact)
+    else:
+        sh += ["# Blast radius not collected. For a sharper plan — which services a patch affects, what",
+               "# must restart (a patched library in memory is still the old one until restart), and whether",
+               "# a reboot is pending — run:  maggie security host-impact --ssh "
+               + (f"{host}=<user@host>" if host else "<alias>=<user@host>"), ""]
+        md += ["> Run `maggie security host-impact` first for a blast-radius-aware plan "
+               "(which services each patch affects, what must restart, whether a reboot is pending).", ""]
+
     apt_packages: list[str] = []
     total = 0
+    tier_counts: dict[str, int] = {t: 0 for t in TIER_ORDER}
+    for action in actions:
+        tier_counts[fix_tier(action)] += 1
     for key, label, note in FIX_CATEGORIES:
         items = buckets.get(key) or []
         if not items:
@@ -664,15 +791,36 @@ def fix_plan(ctx: core.Context) -> dict:
         sh += [f"# =================== {label} ===================", f"# {note}", ""]
         md += [f"## {label}", f"_{note}_", ""]
         if key == "web-server":
+            sh.append("# Tier: T3 — each fix below backs up, validates with `nginx -t`, and auto-reverts on error.")
+            sh.append("")
+            md.append(f"_Risk tier: **{TIER_LABEL['T3']}** — each fix validates and auto-reverts._")
+            md.append("")
             block_sh, block_md = nginx_fix_block(items)
             sh += block_sh
             md += block_md
             total += len(items)
             continue
+        if key == "end-of-life":
+            sh.append(f"# Tier: {TIER_LABEL['T4']}. DO NOT run these as part of this script.")
+            sh.append("# Test each move in staging and schedule a change window. Until then, record an accepted risk:")
+            md.append(f"_Risk tier: **{TIER_LABEL['T4']}** — do not auto-apply. Stage first; record as accepted-risk until scheduled._")
+            md.append("")
+            for action in items:
+                total += 1
+                sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")
+                for fid in action["ids"]:
+                    sh.append(f"# maggie security ledger accept --id {fid} "
+                              f"--reason {shlex.quote(action['title'] + ' — major/EOL upgrade, staging first')}")
+                sh.append("")
+                md.append(f"- **{action['title']}** — {action['why']}")
+                md.append(f"  - accept until staged: `maggie security ledger accept --id {action['ids'][0]} --reason \"…\"`")
+            md.append("")
+            continue
         for action in items:
             total += 1
-            sh.append(f"# [{action['priority']}] {action['title']} — {action['why']}")
-            md.append(f"- **{action['title']}** — {action['why']}")
+            tier = fix_tier(action)
+            sh.append(f"# [{action['priority']}][{tier}] {action['title']} — {action['why']}")
+            md.append(f"- **[{tier}] {action['title']}** — {action['why']}")
             if key == "packages":
                 # Build the fix command ourselves; never copy the finding's step text
                 # (it reads "apt-get install --only-upgrade X  (fixed in Y)" — not valid shell).
@@ -702,11 +850,25 @@ def fix_plan(ctx: core.Context) -> dict:
         md.append("")
     if apt_packages:
         pkgs = " ".join(sorted(set(apt_packages)))
-        insert = ["# Apply available Ubuntu/Debian security updates for the affected packages:",
+        insert = ["# Tier: T1 — distro security updates are ABI-stable within the release; safe to batch.",
+                  "# Back up the package state first so you can roll back a bad upgrade:",
+                  'sudo dpkg --get-selections > "$HOME/maggie-pkg-state.$(date +%F).txt"',
                   "sudo apt-get update",
                   f"sudo apt-get install --only-upgrade {pkgs}",
                   "# Or apply all pending security updates at once:",
-                  "# sudo unattended-upgrade -d    # or: sudo apt-get upgrade", ""]
+                  "# sudo unattended-upgrade -d    # or: sudo apt-get upgrade",
+                  "# Verify nothing broke after upgrading (and restart services if the kernel/libc changed):",
+                  "systemctl list-units --state=failed --no-legend || true",
+                  "sudo nginx -t 2>/dev/null && echo 'nginx config ok' || true"]
+        # A patched library on disk is not live until the services using it restart.
+        svcs = (impact or {}).get("services_need_restart") or []
+        insert += ["# Make the fix live — a patched library in memory is still the old one until restart:",
+                   "sudo needrestart -r l   # list what is still running old code; -r a to act on it"]
+        insert += [f"sudo systemctl restart {s}" for s in svcs[:8]]
+        if (impact or {}).get("reboot_required"):
+            insert += ["# A reboot is pending (kernel/core library) — schedule it in a maintenance window:",
+                       "# sudo shutdown -r +1 'applying security updates'"]
+        insert += ["# If a service failed: downgrade the package (apt-get install pkg=<old>) or restore from the snapshot.", ""]
         anchor = sh.index("# =================== Package updates ===================") + 3
         sh[anchor:anchor] = insert
         md.append("### apt batch")
@@ -724,6 +886,7 @@ def fix_plan(ctx: core.Context) -> dict:
         out.write_text(runbook, encoding="utf-8")
     return {"schema": "maggie-security-fix-plan.v1", "site": ctx.site, "host": host, "generated_at": core.iso(),
             "actions": total, "apt_packages": sorted(set(apt_packages)),
+            "tiers": {t: tier_counts[t] for t in TIER_ORDER if tier_counts[t]},
             "script_path": str(args.script) if args.script else None,
             "note": "Review before running. Maggie never applies these changes.", "markdown": runbook}
 

package/bundled-tools/clis/maggie_security_scan.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""``maggie security scan`` — one command that runs the right detectors for the
+site's profile and then builds a report.
+
+The suite has many focused detectors; chaining them by hand (vuln-watch → deps →
+secrets → headers → tls → host-quick → … → report) is the main source of workflow
+friction, and it is what a scheduled routine or an MCP agent would otherwise have
+to script. ``scan`` reads the profile (from the inventory, or ``--profile``), runs
+exactly the detectors that profile expects, and finishes with a report — each
+detector in its own process, best-effort, so one that degrades or refuses does not
+abort the scan. It never does anything the individual commands would not: web
+checks still need a verified domain, host checks still need ``--ssh`` consent.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import maggie_security_core as core
+import maggie_security_report as report
+
+CLI = Path(__file__).resolve().parent / "maggie_security.py"
+
+# Detectors that need a target beyond the project tree.
+WEB = {"headers", "tls", "web-scan"}                       # need a verified domain
+HOST = {"host-quick", "host-nginx-config", "host-impact"}  # need --ssh ALIAS=user@host
+# Interactive / heavy / uncontrolled-target commands are never auto-run by scan.
+NEVER_AUTORUN = {"logs-remote", "host-audit", "zap-baseline", "public-check", "web-scan", "hosted-job"}
+# Project detectors worth running for any profile even if EXPECTED omits them.
+ALWAYS = ["secrets", "code-scan"]
+
+
+def _argv_for(command: str, args: argparse.Namespace) -> tuple[list[str] | None, str | None]:
+    """The sub-command argv for this scan, or (None, reason) to skip it."""
+    if command in WEB:
+        if not args.domain:
+            return None, "needs a verified domain (pass --domain)"
+        return [command, "--domain", args.domain], None
+    if command in HOST:
+        if not args.ssh:
+            return None, "needs a server (pass --ssh ALIAS=user@host)"
+        return [command, "--ssh", args.ssh], None
+    return [command], None
+
+
+def _findings_count(data: dict) -> int | None:
+    summary = (data or {}).get("summary") or {}
+    if not summary:
+        return None
+    return int(summary.get("new", 0)) + int(summary.get("open", 0))
+
+
+def scan(ctx: core.Context) -> dict:
+    args = ctx.args
+    project = ctx.project
+    import maggie_security as dispatch
+
+    built = set(dispatch.area_commands())
+
+    def run_cmd(argv: list[str]) -> tuple[int, dict, str]:
+        full = [sys.executable, str(CLI), *argv, "--project", str(project), "--format", "json", "--max-items", "200"]
+        if args.offline:
+            full.append("--offline")
+        proc = subprocess.run(full, capture_output=True, text=True, timeout=1800, check=False)
+        try:
+            data = json.loads(proc.stdout) if proc.stdout.strip() else {}
+        except ValueError:
+            data = {}
+        return proc.returncode, (data if isinstance(data, dict) else {}), proc.stderr
+
+    steps: list[dict] = []
+    skipped: list[dict] = []
+
+    # 1. Inventory first, so the profile and every later detector see the same stack.
+    code, data, _ = run_cmd(["inventory"])
+    steps.append({"command": "inventory", "exit": code, "degraded": bool(data.get("degraded"))})
+
+    # 2. Decide the profile.
+    stack_path = ctx.state.path("inventory", "stack.json")
+    profile = args.profile
+    if not profile:
+        if stack_path.is_file():
+            profile = (core.read_json(stack_path).get("site") or {}).get("type") or "unknown"
+        else:
+            profile = core.detect_site_type(project)
+
+    # 3. Build the ordered detector plan from the profile, plus the always-useful ones.
+    plan: list[str] = []
+    for command in list(report.EXPECTED.get(profile, report.EXPECTED["unknown"])) + ALWAYS:
+        if command in built and command not in NEVER_AUTORUN and command not in plan:
+            plan.append(command)
+
+    # 4. Run each detector, best-effort.
+    for command in plan:
+        argv, reason = _argv_for(command, args)
+        if argv is None:
+            skipped.append({"command": command, "reason": reason})
+            continue
+        code, data, _ = run_cmd(argv)
+        steps.append({"command": command, "exit": code, "degraded": bool(data.get("degraded")),
+                      "findings": _findings_count(data),
+                      "refused": code in (core.EXIT_USAGE, core.EXIT_POLICY, core.EXIT_TOOL)})
+
+    # 5. Report (and optionally a fix-plan).
+    rcode, rdata, _ = run_cmd(["report"] + (["--kind", args.kind] if args.kind else []))
+    verdict = ((rdata.get("report") or {}).get("verdict") or {}) if rdata else {}
+    out: dict = {
+        "schema": "maggie-security-scan.v1", "site": ctx.site, "profile": profile,
+        "ran": [s["command"] for s in steps], "skipped": skipped, "steps": steps,
+        "degraded": [s["command"] for s in steps if s.get("degraded")],
+        "verdict": verdict, "report": rdata.get("report") if rdata else None,
+    }
+    if args.fix_plan:
+        _c, fdata, _e = run_cmd(["fix-plan"])
+        out["fix_plan"] = {"actions": fdata.get("actions"), "tiers": fdata.get("tiers")} if fdata else None
+
+    out["markdown"] = render_scan(out, rdata.get("markdown") if rdata else None)
+    # exit code: actionable report -> 1; else degraded -> 3; else 0
+    if verdict.get("code") in ("act-today", "possible-break-in"):
+        out["exit_code"] = core.EXIT_FINDINGS
+    elif out["degraded"]:
+        out["exit_code"] = core.EXIT_DEGRADED
+    return out
+
+
+def render_scan(out: dict, report_md: str | None) -> str:
+    lines = [f"# Security scan — {out['site']} ({out['profile']})", ""]
+    ran = [s for s in out["steps"] if not s.get("refused")]
+    lines.append(f"Ran {len(ran)} checks" + (f", {len(out['degraded'])} degraded" if out["degraded"] else "")
+                 + (f", {len(out['skipped'])} skipped." if out["skipped"] else "."))
+    lines.append("")
+    lines += ["| Check | Result |", "|---|---|"]
+    for step in out["steps"]:
+        if step["command"] == "inventory":
+            result = "degraded" if step["degraded"] else "ok"
+        elif step.get("refused"):
+            result = "refused"
+        elif step.get("findings"):
+            result = f"{step['findings']} finding(s)"
+        elif step["degraded"]:
+            result = "incomplete"
+        else:
+            result = "no issues"
+        lines.append(f"| {step['command']} | {result} |")
+    for skip in out["skipped"]:
+        lines.append(f"| {skip['command']} | skipped: {skip['reason']} |")
+    lines.append("")
+    if out.get("verdict"):
+        lines += [f"**Verdict:** {out['verdict'].get('text', '')}", ""]
+    if report_md:
+        lines += ["---", "", report_md]
+    return "\n".join(lines)
+
+
+def configure(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--profile", choices=sorted(report.EXPECTED), help="override the detected site profile")
+    parser.add_argument("--domain", help="verified domain for the web checks (headers, tls)")
+    parser.add_argument("--ssh", help="ALIAS=user@host for the host checks (needs ssh-read consent)")
+    parser.add_argument("--kind", choices=["weekly", "daily_ops"], help="report kind to build at the end (default: weekly)")
+    parser.add_argument("--fix-plan", action="store_true", dest="fix_plan", help="also build a remediation fix-plan")
+
+
+COMMANDS = [core.Command("scan", "run the detectors for the site's profile, then build a report (one-shot; each detector best-effort)", [],
+                         configure, scan, findings=False)]

package/bundled-tools/clis/maggie_security_web.py

@@ -453,6 +453,50 @@ def csp_problems(value: str) -> list[str]:
     return problems
 
 
+# Letter grade for HTTP security headers, using the additive model from
+# mdn-http-observatory (MPL-2.0; score table and grade chart ported as data):
+# start at 100, apply the single worst penalty per category, map to a letter.
+GRADE_CHART = [(100, "A+"), (85, "A"), (80, "B+"), (70, "B"), (65, "B-"),
+               (60, "C+"), (50, "C"), (45, "C-"), (40, "D+"), (30, "D"), (25, "D-"), (0, "F")]
+# rule_id stem (after the `header-` prefix) -> (category, penalty). Worst per category counts once.
+HEADER_PENALTIES = {
+    "csp-missing": ("csp", -25), "csp-": ("csp", -10),
+    "hsts-missing": ("hsts", -20), "hsts-short": ("hsts", -10),
+    "xcto": ("xcto", -5),
+    "framing": ("framing", -20), "xfo-allow-from": ("framing", -20),
+    "referrer-missing": ("referrer", -5), "referrer-weak": ("referrer", -5),
+    "cors-wildcard-credentials": ("cors", -50),
+    "cookie-": ("cookie", -20),
+    "version-": ("disclosure", -5),
+}
+
+
+def header_grade(findings: list[dict]) -> dict:
+    """Observatory-style score (0–100) and letter grade from the header findings."""
+    worst: dict[str, int] = {}
+    for finding in findings:
+        stem = (finding["source"]["rule_id"] or "").removeprefix("header-")
+        match = HEADER_PENALTIES.get(stem) or next((v for k, v in HEADER_PENALTIES.items() if k.endswith("-") and stem.startswith(k)), None)
+        if match:
+            category, penalty = match
+            worst[category] = min(worst.get(category, 0), penalty)
+    score = max(0, min(100, 100 + sum(worst.values())))
+    grade = next(letter for threshold, letter in GRADE_CHART if score >= threshold)
+    return {"score": score, "grade": grade, "deductions": sorted(worst.items(), key=lambda kv: kv[1])}
+
+
+def grade_finding(ctx: core.Context, url: str, findings: list[dict]) -> dict:
+    g = header_grade(findings)
+    gaps = ", ".join(c for c, _ in g["deductions"]) or "nothing major"
+    summary = (f"Security-header grade {g['grade']} ({g['score']}/100). "
+               + (f"Biggest gaps: {gaps}. Fix the items below to raise it." if g["deductions"] else "No major header gaps."))
+    return core.make_finding(
+        kind="header", command="headers", primary_id="header-grade", site=ctx.site,
+        title=f"HTTP security headers grade: {g['grade']} ({g['score']}/100)", severity="info", severity_source="maggie",
+        confidence="confirmed", target={"url": url, "host": host_of(url)}, rule_id="header-grade",
+        remediation={"summary": summary, "steps": [], "snippets": [], "references": [], "cheat_sheet": None})
+
+
 def grade_response(ctx: core.Context, url: str, response: dict, layer: str, https: bool) -> list[dict]:
     headers = response["headers"]
     first = lambda name: (headers.get(name) or [None])[0]  # noqa: E731
@@ -530,7 +574,7 @@ def grade_response(ctx: core.Context, url: str, response: dict, layer: str, http
     if origin and origin.strip() == "*" and (first("access-control-allow-credentials") or "").lower() == "true":
         add("cors-wildcard-credentials", "CORS allows any origin with credentials", "high", ["V3.4.2"], kind="misconfiguration",
             evidence="Access-Control-Allow-Origin: *; Allow-Credentials: true")
-    return findings
+    return [grade_finding(ctx, url, findings)] + findings
 
 
 def headers_cmd(ctx: core.Context):

package/bundled-tools/clis/security_data/tools.lock.json

@@ -1,6 +1,7 @@
 {
   "schema": "maggie-security-tools-lock.v1",
   "updated": "2026-10-24",
+  "generated_at": "2026-10-24T00:00:00Z",
   "tools": {
     "osv-scanner": {
       "version": "2.6.0",
@@ -104,7 +105,7 @@
       "assets": {
         "linux-amd64": {
           "url": "https://github.com/projectdiscovery/nuclei/releases/download/v3.4.10/nuclei_3.4.10_linux_amd64.zip",
-          "sha256": "UNPINNED",
+          "sha256": "234c12cc5288af071abdcd6f854245b6067345556e1235cf96b76725c1004357",
           "archive": "zip",
           "member": "nuclei"
         }
@@ -137,7 +138,7 @@
       "assets": {
         "linux-amd64": {
           "url": "https://github.com/projectdiscovery/httpx/releases/download/v1.7.1/httpx_1.7.1_linux_amd64.zip",
-          "sha256": "UNPINNED",
+          "sha256": "865806a4eec321368e365b419baa3abdc0deb0d4ba598fe85a548a7c8682eb30",
           "archive": "zip",
           "member": "httpx"
         }
@@ -240,7 +241,7 @@
       "assets": {
         "linux-amd64": {
           "url": "https://github.com/anchore/syft/releases/download/v1.33.0/syft_1.33.0_linux_amd64.tar.gz",
-          "sha256": "UNPINNED",
+          "sha256": "adc1b944a827ed3432bcd9f1dbdbc8fa3c0dca7d3d449e7084c90248c2c6cb50",
           "archive": "tar.gz",
           "member": "syft"
         }
@@ -259,7 +260,7 @@
       "assets": {
         "linux-amd64": {
           "url": "https://github.com/anchore/grype/releases/download/v0.100.0/grype_0.100.0_linux_amd64.tar.gz",
-          "sha256": "UNPINNED",
+          "sha256": "9f4ed948b596a1978ec609eaa5538a9f2558836799b7b0a81f729408daf23e03",
           "archive": "tar.gz",
           "member": "grype"
         }
@@ -271,14 +272,14 @@
       }
     },
     "trivy": {
-      "version": "0.67.2",
+      "version": "0.76.1",
       "licence": "Apache-2.0",
       "class": "bundle-ok",
       "homepage": "https://github.com/aquasecurity/trivy",
       "assets": {
         "linux-amd64": {
-          "url": "https://github.com/aquasecurity/trivy/releases/download/v0.67.2/trivy_0.67.2_Linux-64bit.tar.gz",
-          "sha256": "UNPINNED",
+          "url": "https://github.com/aquasecurity/trivy/releases/download/v0.76.1/trivy_0.76.1_Linux-64bit.tar.gz",
+          "sha256": "c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0",
           "archive": "tar.gz",
           "member": "trivy"
         }
@@ -290,11 +291,38 @@
         "--server"
       ]
     },
+    "copa": {
+      "version": "0.15.0",
+      "licence": "Apache-2.0",
+      "class": "bundle-ok",
+      "homepage": "https://github.com/project-copacetic/copacetic",
+      "binary": "copa",
+      "notes": "Patches OS-package CVEs in a container image from a Trivy report. Needs Docker/buildkit at run time. Used by `image-patch` (plan only; Maggie never runs it).",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/project-copacetic/copacetic/releases/download/v0.15.0/copa_0.15.0_linux_amd64.tar.gz",
+          "sha256": "cff3fe9320f3bd24bafcfd0ce877ef57e23acad0836da0ac6c253919f71c9cad",
+          "archive": "tar.gz",
+          "member": "copa"
+        }
+      },
+      "required_flags": [],
+      "forbidden_flags": ["--push"]
+    },
     "dockle": {
       "version": "0.4.15",
       "licence": "Apache-2.0",
       "class": "bundle-ok",
       "homepage": "https://github.com/goodwithtech/dockle",
+      "binary": "dockle",
+      "assets": {
+        "linux-amd64": {
+          "url": "https://github.com/goodwithtech/dockle/releases/download/v0.4.15/dockle_0.4.15_Linux-64bit.tar.gz",
+          "sha256": "8bfc9183d1d3d67800edb45bea4bb63ddf1d28bec5f89944075a07007d79caad",
+          "archive": "tar.gz",
+          "member": "dockle"
+        }
+      },
       "required_flags": [],
       "forbidden_flags": []
     },
@@ -329,6 +357,7 @@
       "licence": "MIT",
       "class": "bundle-ok",
       "homepage": "https://github.com/perplexityai/bumblebee",
+      "notes": "Optional deferred preinstall engine; not bundled. Install it yourself if you want it; preinstall works without it.",
       "required_flags": [],
       "forbidden_flags": []
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.60",
+  "version": "0.8.0",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",