agent-security-scanner-mcp 4.4.3 → 4.4.6

package/README.md

@@ -4,9 +4,9 @@
 
 # agent-security-scanner-mcp
 
-**Security scanner for AI coding agents and autonomous assistants**
+**npm audit for AI agents and MCP servers**
 
-Scans code for vulnerabilities, detects hallucinated packages, blocks prompt injection, and provides LLM-powered semantic code review — via MCP (Claude Code, Cursor, Windsurf, Cline) or CLI (OpenClaw, CI/CD).
+Scan code, MCP tools, prompts, skills, and AI-suggested dependencies before your agent trusts them. Built for Claude Code, Cursor, Windsurf, Cline, OpenClaw, and CI/CD.
 
 [![npm downloads](https://img.shields.io/npm/dt/agent-security-scanner-mcp.svg)](https://www.npmjs.com/package/agent-security-scanner-mcp)
 [![npm version](https://img.shields.io/npm/v/agent-security-scanner-mcp.svg)](https://www.npmjs.com/package/agent-security-scanner-mcp)
@@ -18,6 +18,41 @@ Scans code for vulnerabilities, detects hallucinated packages, blocks prompt inj
 
 ---
 
+## Start Here
+
+Run the agent security smoke test on any repo:
+
+```bash
+npx agent-security-scanner-mcp scan-project . --verbosity compact
+```
+
+Install it into your AI coding client:
+
+```bash
+npx agent-security-scanner-mcp init claude-code
+```
+
+Replace `claude-code` with `cursor`, `claude-desktop`, `windsurf`, `cline`, `kilo-code`, `opencode`, or `cody`.
+
+### What To Run Before You Trust An Agent
+
+```bash
+# Check the whole project and get an A-F security grade
+npx agent-security-scanner-mcp scan-project . --verbosity compact
+
+# Audit an MCP server before adding it to Claude/Cursor/Windsurf
+npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact
+
+# Verify AI-suggested imports are real packages, not hallucinations
+npx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact
+
+# Add a local environment health check
+npx agent-security-scanner-mcp doctor
+
+# Add the scanner to your AI client
+npx agent-security-scanner-mcp init claude-code
+```
+
 ## 🎯 Two Versions Available
 
 ### 🔥 ProofLayer (Lightweight) - **NEW!**

package/code-review-agent/package.json

@@ -29,7 +29,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.13.0",
-    "tsx": "^4.19.0",
+    "tsx": "^4.22.4",
     "typescript": "^5.7.3",
     "vitest": "^4.1.0"
   }

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "4.0.0",
-  "description": "Security scanner for OpenClaw: prompt injection firewall, package hallucination detection, code vulnerability scanning, auto-fix",
+  "version": "4.4.6",
+  "description": "npm audit for AI agents and OpenClaw skills: prompt injection firewall, package hallucination detection, MCP/security scanning, and auto-fix",
   "author": "Sinewave AI",
   "license": "MIT",
   "openclaw": {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "4.4.3",
+  "version": "4.4.6",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
-  "description": "Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1700+ vulnerability rules with AST & taint analysis, LLM-powered semantic code review, auto-fix. For Claude Code, Cursor, Windsurf, Cline, OpenClaw.",
+  "description": "npm audit for AI agents and MCP servers. Scan code, MCP tools, prompts, and hallucinated packages for Claude Code, Cursor, Windsurf, Cline, OpenClaw, and CI.",
   "main": "index.js",
   "type": "module",
   "bin": {
@@ -20,6 +20,9 @@
   "keywords": [
     "mcp",
     "model-context-protocol",
+    "npm-audit",
+    "agent-audit",
+    "agent-security-audit",
     "claude",
     "opencode",
     "kilocode",
@@ -36,6 +39,9 @@
     "hallucination-detection",
     "package-verification",
     "supply-chain-security",
+    "mcp-security",
+    "mcp-scanner",
+    "mcp-audit",
     "prompt-injection",
     "agent-security",
     "llm-security",
@@ -75,7 +81,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.3",
     "bloom-filters": "^3.0.4",
-    "tar": "^7.5.9",
+    "tar": "^7.5.16",
     "zod": "^4.3.6"
   },
   "files": [

package/server.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.sinewaveai/agent-security-scanner-mcp",
-  "description": "MCP security scanner with prompt injection firewall, package hallucination detection, LLM-powered code review, and auto-fix.",
-  "version": "4.0.0",
+  "description": "npm audit for AI agents and MCP servers: scan code, MCP tools, prompts, and hallucinated packages before agents trust them.",
+  "version": "4.4.6",
   "transport": "stdio",
   "registry": "npm"
 }

package/templates/github-action-security.yml

@@ -0,0 +1,31 @@
+name: Agent Security Scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 9 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  agent-security:
+    name: Scan AI agent, MCP, and supply-chain risk
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: sinewaveai/agent-security-scanner-mcp/.github/actions/security-scan@main
+        with:
+          severity_threshold: warning
+          scan_packages: "true"
+          scan_diff_only: "true"
+          upload_sarif: "true"
+