agent-security-scanner-mcp 2.0.2 → 2.0.4

package/index.js

@@ -1890,8 +1890,11 @@ async function runInit(flags) {
     fileExisted = true;
     const rawContent = readFileSync(configPath, 'utf-8');
     try {
-      // Strip JSONC comments for opencode.jsonc
-      const stripped = rawContent.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+      // For JSONC files, strip comments (but only for .jsonc files to avoid breaking URLs with //)
+      let stripped = rawContent;
+      if (configPath.endsWith('.jsonc')) {
+        stripped = rawContent.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+      }
       config = JSON.parse(stripped);
     } catch (e) {
       console.error(`  ERROR: Invalid JSON in ${configPath}`);
@@ -2097,7 +2100,11 @@ async function runDoctor(flags) {
     let config;
     try {
       const raw = readFileSync(configPath, 'utf-8');
-      const stripped = raw.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+      // Only strip comments for .jsonc files (avoid breaking URLs with //)
+      let stripped = raw;
+      if (configPath.endsWith('.jsonc')) {
+        stripped = raw.replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+      }
       config = JSON.parse(stripped);
     } catch (e) {
       console.log(`    \u2717 ${client.name.padEnd(20)} invalid JSON in config`);
@@ -2164,28 +2171,28 @@ const DEMO_TEMPLATES = {
   js: {
     ext: 'js',
     name: 'JavaScript',
-    code: `const API_KEY = "sk_live_abc123def456ghi789";
-
-const express = require("express");
+    code: `const express = require("express");
+const child_process = require("child_process");
 const app = express();
 
+// SQL Injection vulnerability
 app.get("/user", (req, res) => {
   const userId = req.query.id;
-  const query = "SELECT * FROM users WHERE id = " + userId;
-  db.query(query, (err, result) => {
+  db.query("SELECT * FROM users WHERE id = " + userId, (err, result) => {
     res.send(result);
   });
 });
 
+// XSS vulnerability
 app.get("/profile", (req, res) => {
   const name = req.query.name;
-  res.send("<h1>Welcome, " + name + "</h1>");
+  document.getElementById("welcome").innerHTML = name;
 });
 
+// Command Injection vulnerability
 app.get("/run", (req, res) => {
   const cmd = req.query.cmd;
-  const { exec } = require("child_process");
-  exec(cmd, (err, stdout) => {
+  child_process.exec("ls " + cmd, (err, stdout) => {
     res.send(stdout);
   });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 359 vulnerability rules with auto-fix. For Claude Code, Cursor, Windsurf, Cline.",
   "main": "index.js",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "MCP security scanner with prompt injection firewall, package hallucination detection, and auto-fix.",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "transport": "stdio",
   "registry": "npm"
 }