@vibefoundry/vibe-shield 1.1.0 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/README.md +74 -48
  2. package/SECURITY.md +1 -1
  3. package/SKILL.md +27 -94
  4. package/dist/bin/vibe-shield.d.ts +1 -1
  5. package/dist/bin/vibe-shield.js +572 -541
  6. package/dist/src/init/scaffold.d.ts +29 -31
  7. package/dist/src/init/scaffold.js +69 -153
  8. package/dist/src/mcp/server.js +6 -2
  9. package/dist/src/mcp-guard/skill-auditor.js +11 -3
  10. package/dist/src/reporter/console-reporter.js +17 -3
  11. package/dist/src/reporter/executive.d.ts +4 -0
  12. package/dist/src/reporter/executive.js +58 -0
  13. package/dist/src/reporter/formatters.d.ts +1 -1
  14. package/dist/src/reporter/formatters.js +10 -3
  15. package/dist/src/reporter/patch-prompt-writer.js +5 -5
  16. package/dist/src/scanner/attack-surface.d.ts +4 -0
  17. package/dist/src/scanner/attack-surface.js +50 -0
  18. package/dist/src/scanner/engine.d.ts +2 -3
  19. package/dist/src/scanner/engine.js +21 -35
  20. package/dist/src/scanner/mappings.d.ts +17 -0
  21. package/dist/src/scanner/mappings.js +39 -0
  22. package/dist/src/scanner/redact.d.ts +1 -0
  23. package/dist/src/scanner/redact.js +12 -0
  24. package/dist/src/scanner/rules/database-exposure.js +1 -1
  25. package/dist/src/scanner/rules/hardening.d.ts +5 -0
  26. package/dist/src/scanner/rules/hardening.js +116 -0
  27. package/dist/src/scanner/rules/helpers.js +2 -0
  28. package/dist/src/scanner/rules/index.js +6 -0
  29. package/dist/src/scanner/rules/response-hardening.d.ts +2 -0
  30. package/dist/src/scanner/rules/response-hardening.js +120 -0
  31. package/dist/src/scanner/rules/secret-entropy.js +0 -2
  32. package/dist/src/scanner/rules/shared.d.ts +1 -1
  33. package/dist/src/scanner/rules/shared.js +1 -1
  34. package/dist/src/scanner/types.d.ts +33 -1
  35. package/dist/src/scanner/types.js +6 -2
  36. package/dist/src/scanner/version.d.ts +2 -0
  37. package/dist/src/scanner/version.js +69 -0
  38. package/dist/src/secrets/patterns.js +40 -0
  39. package/package.json +99 -96
package/package.json CHANGED
@@ -1,96 +1,99 @@
1
- {
2
- "name": "@vibefoundry/vibe-shield",
3
- "version": "1.1.0",
4
- "description": "High-speed static security analyzer and MCP/agent-skill guard for AI-generated codebases. Catches the vulnerabilities autonomous coding agents ship: leaked secrets, unguarded mutation routes, missing Postgres RLS, unverified webhooks, prompt injection sinks and XSS.",
5
- "keywords": [
6
- "mcp",
7
- "mcp-server",
8
- "model-context-protocol",
9
- "mcp-tools",
10
- "mcp-security",
11
- "mcp-client",
12
- "json-rpc",
13
- "claude-code",
14
- "claude-desktop",
15
- "codex",
16
- "cursor",
17
- "windsurf",
18
- "ai-agents",
19
- "agent-skills",
20
- "agents-md",
21
- "ai-security",
22
- "ai-generated-code",
23
- "vibe-coding",
24
- "security-scanner",
25
- "vulnerability-scanner",
26
- "static-analysis",
27
- "sast",
28
- "appsec",
29
- "cybersecurity",
30
- "devsecops",
31
- "owasp",
32
- "cwe",
33
- "sarif",
34
- "prompt-injection",
35
- "secret-scanner",
36
- "secrets-detection",
37
- "security-audit",
38
- "supabase-rls",
39
- "nextjs-security",
40
- "row-level-security",
41
- "sql-injection",
42
- "agent-skill-audit",
43
- "github-actions",
44
- "code-scanning",
45
- "ci-security-gate",
46
- "npx",
47
- "typescript",
48
- "zero-dependencies"
49
- ],
50
- "license": "MIT",
51
- "author": "VibeFoundry",
52
- "homepage": "https://github.com/avivgerz-hue/vibe-shield#readme",
53
- "repository": {
54
- "type": "git",
55
- "url": "git+https://github.com/avivgerz-hue/vibe-shield.git"
56
- },
57
- "bugs": {
58
- "url": "https://github.com/avivgerz-hue/vibe-shield/issues"
59
- },
60
- "main": "./dist/src/index.js",
61
- "types": "./dist/src/index.d.ts",
62
- "bin": {
63
- "vibe-shield": "dist/bin/vibe-shield.js"
64
- },
65
- "files": [
66
- "dist/bin",
67
- "dist/src",
68
- "SKILL.md",
69
- "README.md",
70
- "SECURITY.md",
71
- "LICENSE"
72
- ],
73
- "engines": {
74
- "node": ">=18.17.0"
75
- },
76
- "scripts": {
77
- "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
78
- "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/postbuild.mjs",
79
- "typecheck": "tsc -p tsconfig.json --noEmit",
80
- "test": "vitest run",
81
- "test:watch": "vitest",
82
- "coverage": "vitest run --coverage",
83
- "scan:self": "node dist/bin/vibe-shield.js scan",
84
- "audit:self": "node dist/bin/vibe-shield.js audit-skills",
85
- "verify": "npm run typecheck && npm run build && npm test && npm run scan:self && npm run audit:self",
86
- "prepare": "node scripts/prepare.mjs",
87
- "prepublishOnly": "npm run verify"
88
- },
89
- "dependencies": {},
90
- "devDependencies": {
91
- "@types/node": "^22.20.5",
92
- "@vitest/coverage-v8": "^5.1.0",
93
- "typescript": "^5.9.3",
94
- "vitest": "^5.1.0"
95
- }
96
- }
1
+ {
2
+ "name": "@vibefoundry/vibe-shield",
3
+ "version": "2.0.0",
4
+ "description": "High-speed static security analyzer and MCP/agent-skill guard for AI-generated codebases. Catches the vulnerabilities autonomous coding agents ship: leaked secrets, unguarded mutation routes, missing Postgres RLS, unverified webhooks, prompt injection sinks and XSS.",
5
+ "keywords": [
6
+ "mcp",
7
+ "mcp-server",
8
+ "model-context-protocol",
9
+ "mcp-tools",
10
+ "mcp-security",
11
+ "mcp-client",
12
+ "json-rpc",
13
+ "claude-code",
14
+ "claude-desktop",
15
+ "codex",
16
+ "cursor",
17
+ "windsurf",
18
+ "ai-agents",
19
+ "agent-skills",
20
+ "agents-md",
21
+ "ai-security",
22
+ "ai-generated-code",
23
+ "vibe-coding",
24
+ "security-scanner",
25
+ "vulnerability-scanner",
26
+ "static-analysis",
27
+ "sast",
28
+ "appsec",
29
+ "cybersecurity",
30
+ "devsecops",
31
+ "owasp",
32
+ "cwe",
33
+ "sarif",
34
+ "prompt-injection",
35
+ "secret-scanner",
36
+ "secrets-detection",
37
+ "security-audit",
38
+ "supabase-rls",
39
+ "nextjs-security",
40
+ "row-level-security",
41
+ "sql-injection",
42
+ "agent-skill-audit",
43
+ "github-actions",
44
+ "code-scanning",
45
+ "ci-security-gate",
46
+ "npx",
47
+ "typescript",
48
+ "zero-dependencies"
49
+ ],
50
+ "license": "MIT",
51
+ "author": "VibeFoundry",
52
+ "homepage": "https://github.com/avivgerz-hue/vibe-shield#readme",
53
+ "repository": {
54
+ "type": "git",
55
+ "url": "git+https://github.com/avivgerz-hue/vibe-shield.git"
56
+ },
57
+ "bugs": {
58
+ "url": "https://github.com/avivgerz-hue/vibe-shield/issues"
59
+ },
60
+ "main": "./dist/src/index.js",
61
+ "types": "./dist/src/index.d.ts",
62
+ "bin": {
63
+ "vibe-shield": "dist/bin/vibe-shield.js"
64
+ },
65
+ "files": [
66
+ "dist/bin",
67
+ "dist/src",
68
+ "SKILL.md",
69
+ "README.md",
70
+ "SECURITY.md",
71
+ "LICENSE"
72
+ ],
73
+ "engines": {
74
+ "node": ">=18.17.0"
75
+ },
76
+ "scripts": {
77
+ "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
78
+ "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/postbuild.mjs",
79
+ "typecheck": "tsc -p tsconfig.json --noEmit",
80
+ "test": "vitest run",
81
+ "test:watch": "vitest",
82
+ "coverage": "vitest run --coverage",
83
+ "scan:self": "node dist/bin/vibe-shield.js scan",
84
+ "audit:self": "node dist/bin/vibe-shield.js audit-skills",
85
+ "verify": "npm run typecheck && npm run build && npm test && npm run scan:self && npm run audit:self",
86
+ "prepare": "node scripts/prepare.mjs",
87
+ "prepublishOnly": "npm run verify"
88
+ },
89
+ "dependencies": {},
90
+ "devDependencies": {
91
+ "@types/node": "^22.20.5",
92
+ "@vitest/coverage-v8": "^5.1.0",
93
+ "typescript": "^5.9.3",
94
+ "vitest": "^5.1.0"
95
+ },
96
+ "publishConfig": {
97
+ "access": "public"
98
+ }
99
+ }