agent-security-scanner-mcp 1.0.1 → 1.0.2

package/README.md

@@ -1,6 +1,16 @@
 # agent-security-scanner-mcp
 
-An MCP (Model Context Protocol) server for security vulnerability scanning. Detects SQL injection, XSS, command injection, hardcoded secrets, and 160+ security issues.
+A powerful MCP (Model Context Protocol) server for real-time security vulnerability scanning. Integrates with Claude Desktop and Claude Code to automatically detect and fix security issues as you code.
+
+**165 Semgrep-aligned security rules | 105 auto-fix templates | 100% fix coverage**
+
+## Features
+
+- **Real-time scanning** - Detect vulnerabilities instantly as you write code
+- **Auto-fix suggestions** - Get actionable fixes for every security issue
+- **Multi-language support** - JavaScript, TypeScript, Python, Java, Go, Dockerfile
+- **Semgrep-compatible** - Rules aligned with Semgrep registry format
+- **CWE & OWASP mapped** - Every rule includes CWE and OWASP references
 
 ## Installation
 
@@ -17,7 +27,7 @@ npx agent-security-scanner-mcp
 ## Requirements
 
 - Node.js >= 18.0.0
-- Python 3.x (for the analyzer)
+- Python 3.x (for the analyzer engine)
 
 ## Configuration
 
@@ -36,9 +46,13 @@ Add to your `claude_desktop_config.json`:
 }
 ```
 
+**Config file locations:**
+- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
+- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
+
 ### Claude Code
 
-Add to your MCP settings:
+Add to your MCP settings (`~/.claude/settings.json`):
 
 ```json
 {
@@ -57,50 +71,209 @@ Add to your MCP settings:
 
 Scan a file for security vulnerabilities and return issues with suggested fixes.
 
-**Parameters:**
-- `file_path` (string): Path to the file to scan
+```
+Parameters:
+  file_path (string): Absolute path to the file to scan
+
+Returns:
+  - List of security issues
+  - Severity level (ERROR, WARNING, INFO)
+  - CWE and OWASP references
+  - Line numbers and code context
+  - Suggested fixes
+```
 
-**Returns:** List of security issues with severity, CWE references, and fix suggestions.
+**Example output:**
+```json
+{
+  "file": "/path/to/file.js",
+  "language": "javascript",
+  "issues_count": 3,
+  "issues": [
+    {
+      "ruleId": "javascript.lang.security.audit.sql-injection",
+      "message": "SQL Injection detected. Use parameterized queries.",
+      "line": 15,
+      "severity": "error",
+      "metadata": {
+        "cwe": "CWE-89",
+        "owasp": "A03:2021 - Injection"
+      },
+      "suggested_fix": {
+        "description": "Use parameterized queries instead of string concatenation",
+        "original": "db.query(\"SELECT * FROM users WHERE id = \" + userId)",
+        "fixed": "db.query(\"SELECT * FROM users WHERE id = ?\", [userId])"
+      }
+    }
+  ]
+}
+```
 
 ### `fix_security`
 
-Scan a file and return the fixed content with all security issues resolved.
+Automatically fix all security issues in a file.
 
-**Parameters:**
-- `file_path` (string): Path to the file to fix
+```
+Parameters:
+  file_path (string): Absolute path to the file to fix
 
-**Returns:** Fixed file content with applied security fixes.
+Returns:
+  - Number of fixes applied
+  - Details of each fix
+  - Fixed file content
+```
 
 ### `list_security_rules`
 
-List all available security fix templates and their descriptions.
-
-## Detected Vulnerabilities
-
-| Category | Examples |
-|----------|----------|
-| Injection | SQL injection, Command injection, XSS |
-| Secrets | Hardcoded API keys, passwords, private keys |
-| Cryptography | Weak hashing (MD5, SHA1), insecure random |
-| Deserialization | Pickle, unsafe YAML load |
-| Network | SSL verification disabled, HTTP usage |
-| Path Traversal | Unsanitized file paths |
-
-## Supported Languages
-
-- JavaScript / TypeScript
-- Python
-- Java
-- Go
-- Ruby
-- PHP
-- Dockerfile
-- Generic (secrets detection)
+List all 105 available auto-fix templates.
+
+## Security Rules (165 total)
+
+### By Language
+
+| Language | Rules | Categories |
+|----------|-------|------------|
+| JavaScript/TypeScript | 31 | XSS, injection, secrets, crypto |
+| Python | 36 | Injection, deserialization, crypto, XXE |
+| Java | 27 | Injection, XXE, crypto, deserialization |
+| Go | 22 | Injection, crypto, race conditions |
+| Dockerfile | 18 | Secrets, permissions, best practices |
+| Generic (Secrets) | 31 | API keys, tokens, passwords |
+
+### By Category
+
+| Category | Rules | Auto-Fix |
+|----------|-------|----------|
+| **Injection (SQL, Command, XSS)** | 35 | Yes |
+| **Hardcoded Secrets** | 45 | Yes |
+| **Weak Cryptography** | 18 | Yes |
+| **Insecure Deserialization** | 12 | Yes |
+| **Path Traversal** | 6 | Yes |
+| **SSRF** | 6 | Yes |
+| **XXE** | 6 | Yes |
+| **SSL/TLS Issues** | 8 | Yes |
+| **CSRF** | 4 | Yes |
+| **JWT Vulnerabilities** | 6 | Yes |
+| **Dockerfile Security** | 18 | Yes |
+| **Other** | 11 | Yes |
+
+## Auto-Fix Templates (105 total)
+
+Every detected vulnerability includes an automatic fix suggestion:
+
+| Vulnerability | Fix Strategy |
+|--------------|--------------|
+| SQL Injection | Parameterized queries with placeholders |
+| XSS (innerHTML) | Replace with `textContent` or DOMPurify |
+| Command Injection | Use `execFile()` / `spawn()` with `shell: false` |
+| Hardcoded Secrets | Environment variables (`process.env` / `os.environ`) |
+| Weak Crypto (MD5/SHA1) | Replace with SHA-256 |
+| Insecure Deserialization | Use `json.load()` or `yaml.safe_load()` |
+| SSL verify=False | Set `verify=True` |
+| Path Traversal | Use `path.basename()` / `os.path.basename()` |
+| Eval/Exec | Remove or use safer alternatives |
+| CORS Wildcard | Specify allowed origins |
+
+## Example Usage
+
+### Scanning a file
+
+Ask Claude: *"Scan my app.js file for security issues"*
+
+Claude will use `scan_security` and return:
+- All vulnerabilities found
+- Severity levels
+- CWE/OWASP references
+- Suggested fixes for each issue
+
+### Auto-fixing issues
+
+Ask Claude: *"Fix all security issues in app.js"*
+
+Claude will use `fix_security` to:
+- Apply all available auto-fixes
+- Return the secured code
+- List all changes made
+
+## Supported Vulnerabilities
+
+### Injection
+- SQL Injection (multiple databases)
+- NoSQL Injection (MongoDB)
+- Command Injection (exec, spawn, subprocess)
+- XSS (innerHTML, document.write, React dangerouslySetInnerHTML)
+- LDAP Injection
+- XPath Injection
+- Template Injection (Jinja2, SpEL)
+
+### Secrets & Credentials
+- AWS Access Keys & Secret Keys
+- GitHub Tokens (PAT, OAuth, App)
+- Stripe API Keys
+- OpenAI API Keys
+- Slack Tokens & Webhooks
+- Database URLs & Passwords
+- Private Keys (RSA, SSH)
+- JWT Secrets
+- 25+ more token types
+
+### Cryptography
+- Weak Hashing (MD5, SHA1)
+- Weak Ciphers (DES, RC4)
+- ECB Mode Usage
+- Insecure Random
+- Weak RSA Key Size
+- Weak TLS Versions
+
+### Deserialization
+- Python pickle/marshal/shelve
+- YAML unsafe load
+- Java ObjectInputStream
+- Node serialize
+- Go gob decode
+
+### Network & SSL
+- SSL Verification Disabled
+- Certificate Validation Bypass
+- SSRF Vulnerabilities
+- Open Redirects
+- CORS Misconfiguration
+
+### Other
+- Path Traversal
+- XXE (XML External Entities)
+- CSRF Disabled
+- Debug Mode Enabled
+- Prototype Pollution
+- ReDoS (Regex DoS)
+- Race Conditions
+
+## Contributing
+
+Contributions welcome! Please see our [GitHub repository](https://github.com/sinewaveai/agent-security-layer-fork).
+
+### Adding New Rules
+
+Rules are defined in YAML format in the `rules/` directory:
+
+```yaml
+- id: language.category.rule-name
+  languages: [javascript]
+  severity: ERROR
+  message: "Description of the vulnerability"
+  patterns:
+    - "regex_pattern"
+  metadata:
+    cwe: "CWE-XXX"
+    owasp: "Category"
+```
 
 ## License
 
 MIT
 
-## Repository
+## Links
 
-https://github.com/sinewaveai/agent-security-layer-fork
+- **npm:** https://www.npmjs.com/package/agent-security-scanner-mcp
+- **GitHub:** https://github.com/sinewaveai/agent-security-layer-fork
+- **Issues:** https://github.com/sinewaveai/agent-security-layer-fork/issues

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "MCP server for security vulnerability scanning - detects SQL injection, XSS, command injection, hardcoded secrets, and more",
   "main": "index.js",
   "type": "module",