agent-security-lens 0.1.0

package/schemas/assessment-result.schema.json

@@ -0,0 +1,361 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsecuritylens.dev/schemas/assessment-result.schema.json",
+  "title": "AgentSecurityLens Assessment Result",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "tool",
+    "assessment",
+    "lineage",
+    "profiles",
+    "rule_packs",
+    "recommendation_packs",
+    "trust_signal_taxonomies",
+    "trust_signals",
+    "summary",
+    "findings"
+  ],
+  "properties": {
+    "schema_version": {
+      "type": "string"
+    },
+    "tool": {
+      "type": "object",
+      "required": ["name", "version"],
+      "properties": {
+        "name": { "type": "string" },
+        "version": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "assessment": {
+      "type": "object",
+      "required": ["id", "target_path", "target_url", "started_at", "completed_at"],
+      "properties": {
+        "id": { "type": "string" },
+        "target_path": { "type": "string" },
+        "target_url": { "type": "string" },
+        "started_at": { "type": "string" },
+        "completed_at": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "lineage": {
+      "type": "object",
+      "required": ["profile_selection", "algorithms"],
+      "properties": {
+        "profile_selection": {
+          "type": "object",
+          "required": ["mode", "requested_profile", "selected_profile", "detection_signals"],
+          "properties": {
+            "mode": { "type": "string", "enum": ["requested", "autodetected"] },
+            "requested_profile": { "type": ["string", "null"] },
+            "selected_profile": { "type": "string" },
+            "detection_signals": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": ["type", "value"],
+                "properties": {
+                  "type": { "type": "string" },
+                  "value": { "type": "string" }
+                },
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "algorithms": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["id", "version"],
+            "properties": {
+              "id": { "type": "string" },
+              "version": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "profiles": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "version", "status", "confidence", "coverage", "known_limitations"],
+        "properties": {
+          "id": { "type": "string" },
+          "version": { "type": "string" },
+          "status": { "type": "string" },
+          "confidence": { "type": "number" },
+          "coverage": { "type": "number" },
+          "known_limitations": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    "rule_packs": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "version", "rule_count"],
+        "properties": {
+          "id": { "type": "string" },
+          "version": { "type": "string" },
+          "rule_count": { "type": "integer" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "recommendation_packs": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "version", "status", "recommendation_count"],
+        "properties": {
+          "id": { "type": "string" },
+          "version": { "type": "string" },
+          "status": { "type": "string" },
+          "recommendation_count": { "type": "integer" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "trust_signal_taxonomies": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "version", "status", "signal_count"],
+        "properties": {
+          "id": { "type": "string" },
+          "version": { "type": "string" },
+          "status": { "type": "string" },
+          "signal_count": { "type": "integer" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "trust_signals": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "signal_id",
+          "title",
+          "direction",
+          "weight",
+          "source_type",
+          "applies_to",
+          "description",
+          "evidence"
+        ],
+        "properties": {
+          "id": { "type": "string" },
+          "signal_id": { "type": "string" },
+          "title": { "type": "string" },
+          "direction": { "type": "string" },
+          "weight": { "type": "integer" },
+          "source_type": { "type": "string" },
+          "applies_to": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "description": { "type": "string" },
+          "evidence": {
+            "type": "object",
+            "required": ["finding_id", "rule_id", "path", "line", "preview"],
+            "properties": {
+              "finding_id": { "type": "string" },
+              "rule_id": { "type": "string" },
+              "path": { "type": "string" },
+              "line": { "type": "integer" },
+              "preview": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    "summary": {
+      "type": "object",
+      "required": ["total_findings", "by_severity", "by_category", "trust_score", "scoring_model"],
+      "properties": {
+        "total_findings": { "type": "integer" },
+        "by_severity": { "type": "object" },
+        "by_category": { "type": "object" },
+        "trust_score": { "type": "integer" },
+        "scoring_model": { "type": "string" }
+      },
+      "additionalProperties": true
+    },
+    "observations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["type", "path", "json_path", "line", "severity_hint"],
+        "properties": {
+          "type": { "type": "string" },
+          "path": { "type": "string" },
+          "json_path": { "type": "string" },
+          "line": { "type": "integer" },
+          "value": {},
+          "severity_hint": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "risk_domains": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "title", "count", "highest_severity", "findings"],
+        "properties": {
+          "id": { "type": "string" },
+          "title": { "type": "string" },
+          "count": { "type": "integer" },
+          "highest_severity": { "type": ["string", "null"] },
+          "findings": {
+            "type": "array",
+            "items": { "type": "string" }
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    "findings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "rule_id",
+          "title",
+          "category",
+          "severity",
+          "confidence",
+          "permissions",
+          "profile_ids",
+          "why_it_matters",
+          "recommended_actions",
+          "recommended_alternatives",
+          "migration_instruction",
+          "evidence"
+        ],
+        "properties": {
+          "id": { "type": "string" },
+          "rule_id": { "type": "string" },
+          "title": { "type": "string" },
+          "category": { "type": "string" },
+          "severity": { "type": "string" },
+          "confidence": { "type": "number" },
+          "permissions": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "profile_ids": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "why_it_matters": { "type": "string" },
+          "recommended_actions": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "recommended_alternatives": {
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "migration_instruction": { "type": "string" },
+          "recommendations": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": [
+                "id",
+                "title",
+                "type",
+                "status",
+                "source",
+                "confidence",
+                "rank",
+                "recommended_actions",
+                "recommended_alternatives",
+                "agent_instruction",
+                "one_step_commands",
+                "rollback_note"
+              ],
+              "properties": {
+                "id": { "type": "string" },
+                "title": { "type": "string" },
+                "type": { "type": "string" },
+                "status": { "type": "string" },
+                "source": { "type": "string" },
+                "confidence": { "type": "number" },
+                "rank": { "type": "integer" },
+                "recommended_actions": {
+                  "type": "array",
+                  "items": { "type": "string" }
+                },
+                "recommended_alternatives": {
+                  "type": "array",
+                  "items": { "type": "string" }
+                },
+                "agent_instruction": { "type": "string" },
+                "one_step_commands": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "required": ["title", "command", "platform", "requires_confirmation"],
+                    "properties": {
+                      "title": { "type": "string" },
+                      "command": { "type": "string" },
+                      "platform": { "type": "string" },
+                      "requires_confirmation": { "type": "boolean" }
+                    },
+                    "additionalProperties": false
+                  }
+                },
+                "rollback_note": { "type": "string" }
+              },
+              "additionalProperties": false
+            }
+          },
+          "evidence": {
+            "type": "object",
+            "required": ["path", "line", "preview"],
+            "properties": {
+              "path": { "type": "string" },
+              "line": { "type": "integer" },
+              "preview": { "type": "string" }
+            },
+            "additionalProperties": false
+          },
+          "evidence_items": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "required": ["path", "line", "preview"],
+              "properties": {
+                "path": { "type": "string" },
+                "line": { "type": "integer" },
+                "preview": { "type": "string" }
+              },
+              "additionalProperties": false
+            }
+          }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/comparison-result.schema.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsecuritylens.dev/schemas/comparison-result.schema.json",
+  "title": "AgentSecurityLens Comparison Result",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "comparison",
+    "score",
+    "finding_counts",
+    "profiles",
+    "rule_packs",
+    "recommendation_packs",
+    "findings"
+  ],
+  "properties": {
+    "schema_version": { "type": "string" },
+    "comparison": {
+      "type": "object",
+      "required": [
+        "previous_assessment_id",
+        "current_assessment_id",
+        "previous_completed_at",
+        "current_completed_at",
+        "compared_at"
+      ],
+      "properties": {
+        "previous_assessment_id": { "type": "string" },
+        "current_assessment_id": { "type": "string" },
+        "previous_completed_at": { "type": "string" },
+        "current_completed_at": { "type": "string" },
+        "compared_at": { "type": "string" }
+      },
+      "additionalProperties": false
+    },
+    "score": {
+      "type": "object",
+      "required": ["previous", "current", "delta"],
+      "properties": {
+        "previous": { "type": "integer" },
+        "current": { "type": "integer" },
+        "delta": { "type": "integer" }
+      },
+      "additionalProperties": false
+    },
+    "finding_counts": {
+      "type": "object",
+      "required": ["previous", "current", "added", "resolved", "persistent"],
+      "properties": {
+        "previous": { "type": "integer" },
+        "current": { "type": "integer" },
+        "added": { "type": "integer" },
+        "resolved": { "type": "integer" },
+        "persistent": { "type": "integer" }
+      },
+      "additionalProperties": false
+    },
+    "profiles": { "$ref": "#/$defs/versioned_diff" },
+    "rule_packs": { "$ref": "#/$defs/versioned_diff" },
+    "recommendation_packs": { "$ref": "#/$defs/versioned_diff" },
+    "findings": {
+      "type": "object",
+      "required": ["added", "resolved", "persistent"],
+      "properties": {
+        "added": { "$ref": "#/$defs/finding_list" },
+        "resolved": { "$ref": "#/$defs/finding_list" },
+        "persistent": { "$ref": "#/$defs/finding_list" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "$defs": {
+    "versioned_diff": {
+      "type": "object",
+      "required": ["added", "removed", "changed"],
+      "properties": {
+        "added": { "type": "array", "items": { "type": "object" } },
+        "removed": { "type": "array", "items": { "type": "object" } },
+        "changed": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["id", "previous_version", "current_version"],
+            "properties": {
+              "id": { "type": "string" },
+              "previous_version": { "type": "string" },
+              "current_version": { "type": "string" }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "finding_list": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "rule_id", "title", "severity", "category", "evidence"],
+        "properties": {
+          "id": { "type": "string" },
+          "rule_id": { "type": "string" },
+          "title": { "type": "string" },
+          "severity": { "type": "string" },
+          "category": { "type": "string" },
+          "evidence": { "type": "object" }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/component-alternative-graph.schema.json

@@ -0,0 +1,187 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsecuritylens.dev/schemas/component-alternative-graph.schema.json",
+  "title": "AgentSecurityLens Component Alternative Graph",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "graph_id",
+    "version",
+    "generated_at",
+    "policy",
+    "component_capabilities",
+    "edges",
+    "coverage_gaps"
+  ],
+  "properties": {
+    "schema_version": { "const": "0.1.0" },
+    "graph_id": { "type": "string", "minLength": 1 },
+    "version": { "type": "string", "minLength": 1 },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "policy": {
+      "type": "object",
+      "required": ["agent_facing_relationships", "minimum_confidence", "minimum_safety_delta"],
+      "properties": {
+        "agent_facing_relationships": {
+          "type": "array",
+          "items": { "enum": ["verified_alternative", "conditional_alternative"] }
+        },
+        "minimum_confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+        "minimum_safety_delta": { "type": "integer" }
+      },
+      "additionalProperties": false
+    },
+    "component_capabilities": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "component_id",
+          "component_type",
+          "primary_capability",
+          "capabilities",
+          "constraints",
+          "evidence"
+        ],
+        "properties": {
+          "component_id": { "type": "string", "minLength": 1 },
+          "component_type": { "enum": ["mcp", "skill", "agent-framework"] },
+          "primary_capability": { "type": "string", "minLength": 1 },
+          "capabilities": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          },
+          "constraints": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          },
+          "evidence": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "$ref": "#/$defs/evidence" }
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    "edges": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "id",
+          "source_component_id",
+          "target_component_id",
+          "relationship_type",
+          "status",
+          "confidence",
+          "safety_delta",
+          "shared_capabilities",
+          "unsupported_source_capabilities",
+          "conditions",
+          "migration",
+          "reason",
+          "evidence",
+          "reviewed_by",
+          "valid_from"
+        ],
+        "properties": {
+          "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]*$" },
+          "source_component_id": { "type": "string", "minLength": 1 },
+          "target_component_id": { "type": "string", "minLength": 1 },
+          "relationship_type": {
+            "enum": [
+              "verified_alternative",
+              "conditional_alternative",
+              "functional_peer",
+              "adjacent_capability"
+            ]
+          },
+          "status": { "enum": ["candidate", "active", "deprecated", "archived"] },
+          "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+          "safety_delta": { "type": "integer", "minimum": -100, "maximum": 100 },
+          "shared_capabilities": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          },
+          "unsupported_source_capabilities": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 },
+            "uniqueItems": true
+          },
+          "conditions": {
+            "type": "array",
+            "items": { "type": "string", "minLength": 1 }
+          },
+          "migration": {
+            "type": "object",
+            "required": ["complexity", "user_confirmation_required", "steps"],
+            "properties": {
+              "complexity": { "enum": ["low", "medium", "high"] },
+              "user_confirmation_required": { "type": "boolean" },
+              "steps": {
+                "type": "array",
+                "minItems": 1,
+                "items": { "type": "string", "minLength": 1 }
+              }
+            },
+            "additionalProperties": false
+          },
+          "reason": { "type": "string", "minLength": 1 },
+          "evidence": {
+            "type": "array",
+            "minItems": 2,
+            "items": { "$ref": "#/$defs/evidence" }
+          },
+          "reviewed_by": { "type": "string", "minLength": 1 },
+          "valid_from": { "type": "string", "format": "date-time" },
+          "valid_until": { "type": ["string", "null"], "format": "date-time" }
+        },
+        "additionalProperties": false
+      }
+    },
+    "coverage_gaps": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "component_id",
+          "primary_capability",
+          "status",
+          "reason",
+          "target_research_queries"
+        ],
+        "properties": {
+          "component_id": { "type": "string", "minLength": 1 },
+          "primary_capability": { "type": "string", "minLength": 1 },
+          "status": { "const": "research_required" },
+          "reason": { "type": "string", "minLength": 1 },
+          "target_research_queries": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "minLength": 1 }
+          }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "$defs": {
+    "evidence": {
+      "type": "object",
+      "required": ["source_url", "claim", "accessed_at"],
+      "properties": {
+        "source_url": { "type": "string", "format": "uri" },
+        "claim": { "type": "string", "minLength": 1 },
+        "accessed_at": { "type": "string", "format": "date-time" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}