agent-security-scanner-mcp 3.10.1 → 3.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "3.10.1",
+  "version": "3.10.3",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix. For Claude Code, Cursor, Windsurf, Cline, OpenClaw.",
   "main": "index.js",

package/src/cli/doctor.js

@@ -3,6 +3,7 @@ import { readFileSync, existsSync, writeFileSync, copyFileSync, mkdirSync } from
 import { dirname, join } from "path";
 import { homedir, platform } from "os";
 import { fileURLToPath } from "url";
+import { getDaemonClient } from '../daemon-client.js';
 
 // Handle both ESM and CJS bundling (Smithery bundles to CJS)
 let __dirname;
@@ -158,6 +159,18 @@ export async function runDoctor(args) {
     console.log(`    \u26a0 daemon.py not found (daemon mode unavailable, sync fallback will be used)`);
   }
 
+  // 3c. Daemon live health check
+  if (existsSync(daemonPath) && pythonCmd) {
+    try {
+      const client = getDaemonClient();
+      const health = await client.health();
+      console.log(`    \u2713 Daemon responding (pid=${health.pid}, cache=${health.cache_size}, uptime=${health.uptime.toFixed(1)}s)`);
+      await client.shutdown();
+    } catch (e) {
+      console.log(`    \u26a0 Daemon health check failed: ${e.message}`);
+    }
+  }
+
   // 4. Python can import yaml (analyzer dependency check)
   if (pythonCmd && existsSync(analyzerPath)) {
     const yamlCheck = checkCommand(pythonCmd, ['-c', 'import yaml; print("ok")']);

package/src/daemon-client.js

@@ -13,7 +13,7 @@ try {
 
 const DAEMON_SCRIPT = join(__dirname, '..', 'daemon.py');
 const READY_TIMEOUT = 15000;   // 15s to wait for __ready__ signal
-const REQUEST_TIMEOUT = 30000; // 30s per request
+const REQUEST_TIMEOUT = 45000; // 45s per request (increased for large files in Codex/complex analysis)
 const MAX_RESTARTS = 3;
 const RESTART_WINDOW = 60000;  // 60s window for restart counting
 

package/src/tools/scan-security.js

@@ -1,6 +1,6 @@
 // src/tools/scan-security.js
 import { z } from "zod";
-import { existsSync, readFileSync } from "fs";
+import { existsSync, readFileSync, statSync } from "fs";
 import { dirname } from "path";
 import { detectLanguage, runAnalyzerAsync, generateFix, toSarif, getEngineMode, extractImports, isTestFile } from '../utils.js';
 import { deduplicateFindings } from '../dedup.js';
@@ -8,6 +8,8 @@ import { applyContextFilter, detectFrameworks, applyFrameworkAdjustments } from
 import { loadConfig, shouldExcludeFile, applyConfig } from '../config.js';
 import { discoverProjectContext } from './project-context.js';
 
+const MAX_FILE_SIZE = 1024 * 1024;  // 1MB - skip files larger than this to avoid timeouts
+
 export const scanSecuritySchema = {
   file_path: z.string().describe("Path to the file to scan"),
   output_format: z.enum(['json', 'sarif']).optional().describe("Output format: 'json' (default) or 'sarif' for GitHub/GitLab integration"),
@@ -69,6 +71,26 @@ export async function scanSecurity({ file_path, output_format, verbosity, engine
     };
   }
 
+  // Check file size to avoid timeouts on very large files
+  try {
+    const stats = statSync(file_path);
+    if (stats.size > MAX_FILE_SIZE) {
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            file: file_path,
+            message: `File too large (${(stats.size / 1024).toFixed(0)}KB). Skipping to avoid timeout. Max size: ${MAX_FILE_SIZE / 1024}KB.`,
+            issues_count: 0,
+            skipped: true
+          })
+        }]
+      };
+    }
+  } catch (err) {
+    // If stat fails, continue anyway
+  }
+
   // Load project configuration
   const config = loadConfig(file_path);
 

package/src/utils.js

@@ -86,7 +86,7 @@ export function runAnalyzer(filePath, engine = 'auto') {
     }
     const result = execFileSync('python3', args, {
       encoding: 'utf-8',
-      timeout: 30000
+      timeout: 45000  // Increased to 45s to match daemon timeout
     });
     return JSON.parse(result);
   } catch (error) {