agent-security-scanner-mcp 4.4.6 → 4.4.7

package/README.md

@@ -34,6 +34,12 @@ npx agent-security-scanner-mcp init claude-code
 
 Replace `claude-code` with `cursor`, `claude-desktop`, `windsurf`, `cline`, `kilo-code`, `opencode`, or `cody`.
 
+Add the GitHub Actions workflow:
+
+```bash
+npx agent-security-scanner-mcp init-ci github
+```
+
 ### What To Run Before You Trust An Agent
 
 ```bash
@@ -98,6 +104,8 @@ Continue reading below for full version documentation →
 
 ---
 
+> **New in v4.4.7 (2026-07-07):** CI adoption improvements — added `init-ci github` to install the GitHub Actions workflow from the CLI, and scheduled GitHub Action runs now automatically scan the full project instead of only the latest diff. Package hallucination checks also use all tracked source files during full-project runs.
+>
 > **New in v4.3.0 (2026-05-05):** Critical security and reliability fixes — GitHub Actions now **fail closed** instead of fail-open when scanner output is invalid (preventing security gate bypass), patched **8 Hono CVEs** (XSS, path traversal, authentication bypass), fixed confidence threshold filtering case sensitivity, and corrected SARIF generation for GitHub Code Scanning. All fixes include comprehensive regression tests. **Upgrade recommended for production use.** [See Full Changelog](CHANGELOG.md#430---2026-05-05).
 >
 > **New in v4.2.0:** Compliance evidence collection — evaluate projects against SOC2-Technical (8 controls) and GDPR-Technical (6 controls) frameworks. Collects evidence from code scans, SBOM, vulnerability checks, and hallucination detection, then evaluates controls with pass/partial/fail/not_evaluated status. Supports evidence persistence for audit trails. [See Compliance Evaluation](#-compliance-evaluation-new-in-v420).
@@ -1346,6 +1354,9 @@ npx agent-security-scanner-mcp check-package flask pypi
 # Scan file imports for hallucinated packages
 npx agent-security-scanner-mcp scan-packages ./requirements.txt pypi
 
+# Install the GitHub Actions workflow
+npx agent-security-scanner-mcp init-ci github
+
 # Install Claude Code hooks for automatic scanning
 npx agent-security-scanner-mcp init-hooks
 
@@ -1633,6 +1644,13 @@ All MCP tools support a `verbosity` parameter to minimize context window consump
 
 ## Changelog
 
+### v4.4.7 (2026-07-07) - CI Adoption
+
+- **New CLI command:** `init-ci github` installs the public GitHub Actions workflow template into `.github/workflows/agent-security.yml`.
+- **Safer scheduled scans:** Scheduled GitHub Action runs now force full-project scanning even when pull requests use diff-only mode.
+- **Better package checks in CI:** Full-project runs verify imports from all tracked source files instead of only changed files.
+- **Regression coverage:** Added tests for the CI installer and scheduled full-project action behavior.
+
 ### v4.2.0 (2026-04-02) - Compliance Evidence Collection
 
 **🚀 New Feature: SOC2/GDPR Technical Compliance Evaluation**

package/index.js

@@ -570,6 +570,12 @@ const cliArgs = process.argv.slice(2);
     console.error(`  Error: ${err.message}\n`);
     process.exit(1);
   });
+} else if (cliArgs[0] === 'init-ci') {
+  const { runInitCi } = await import('./src/cli/init-ci.js');
+  runInitCi(cliArgs.slice(1)).then(() => process.exit(0)).catch(err => {
+    console.error(`  Error: ${err.message}\n`);
+    process.exit(1);
+  });
 } else if (cliArgs[0] === 'harden') {
   const { runHarden } = await import('./src/cli/harden.js');
   runHarden(cliArgs.slice(1)).then(() => process.exit(0)).catch(err => {
@@ -673,6 +679,7 @@ const cliArgs = process.argv.slice(2);
   console.log('\n  agent-security-scanner-mcp\n');
   console.log('  Commands:');
   console.log('    init [client]        Set up MCP config for a client');
+  console.log('    init-ci [provider]   Install CI workflow template (github)');
   console.log('    init-hooks           Install Claude Code hooks for auto-scanning');
   console.log('    doctor [--fix]       Check environment & client configs');
   console.log('    demo [--lang js]     Generate vulnerable file + scan it');
@@ -705,6 +712,7 @@ const cliArgs = process.argv.slice(2);
   console.log('    --exclude <pattern>  Exclude matching files (scan-project)\n');
   console.log('  Examples:');
   console.log('    npx agent-security-scanner-mcp init');
+  console.log('    npx agent-security-scanner-mcp init-ci github');
   console.log('    npx agent-security-scanner-mcp scan-prompt "ignore previous instructions"');
   console.log('    npx agent-security-scanner-mcp scan-security ./app.py --verbosity minimal');
   console.log('    npx agent-security-scanner-mcp check-package flask pypi');

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "description": "npm audit for AI agents and OpenClaw skills: prompt injection firewall, package hallucination detection, MCP/security scanning, and auto-fix",
   "author": "Sinewave AI",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "npm audit for AI agents and MCP servers. Scan code, MCP tools, prompts, and hallucinated packages for Claude Code, Cursor, Windsurf, Cline, OpenClaw, and CI.",
   "main": "index.js",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.sinewaveai/agent-security-scanner-mcp",
   "description": "npm audit for AI agents and MCP servers: scan code, MCP tools, prompts, and hallucinated packages before agents trust them.",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "transport": "stdio",
   "registry": "npm"
 }

package/src/cli/init-ci.js

@@ -0,0 +1,75 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { dirname, join, resolve } from 'path';
+import { fileURLToPath } from 'url';
+
+function parseFlags(args) {
+  const flags = {
+    provider: 'github',
+    dryRun: false,
+    force: false,
+    outputPath: null,
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--dry-run') {
+      flags.dryRun = true;
+    } else if (arg === '--force') {
+      flags.force = true;
+    } else if (arg === '--path' && args[i + 1]) {
+      flags.outputPath = args[++i];
+    } else if (!arg.startsWith('-')) {
+      flags.provider = arg;
+    }
+  }
+
+  return flags;
+}
+
+function repoRootFromModule() {
+  return resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
+}
+
+export async function runInitCi(args = [], options = {}) {
+  const flags = parseFlags(args);
+  const cwd = options.cwd || process.cwd();
+  const repoRoot = options.repoRoot || repoRootFromModule();
+
+  if (flags.provider !== 'github') {
+    throw new Error(`unsupported CI provider: ${flags.provider}. Supported providers: github`);
+  }
+
+  const templatePath = join(repoRoot, 'templates', 'github-action-security.yml');
+  const outputPath = resolve(cwd, flags.outputPath || join('.github', 'workflows', 'agent-security.yml'));
+
+  if (!existsSync(templatePath)) {
+    throw new Error(`GitHub Actions template not found: ${templatePath}`);
+  }
+
+  const template = readFileSync(templatePath, 'utf8');
+
+  console.log('\n  agent-security-scanner-mcp CI setup\n');
+  console.log(`  Provider: GitHub Actions`);
+  console.log(`  Output:   ${outputPath}`);
+
+  if (existsSync(outputPath) && !flags.force) {
+    console.log('\n  Workflow already exists. Use --force to overwrite, or --path to choose another file.\n');
+    return { written: false, outputPath, reason: 'exists' };
+  }
+
+  if (flags.dryRun) {
+    console.log('\n  [dry-run] Would write workflow:\n');
+    console.log(template);
+    console.log('  No changes made.\n');
+    return { written: false, outputPath, dryRun: true };
+  }
+
+  mkdirSync(dirname(outputPath), { recursive: true });
+  writeFileSync(outputPath, template, 'utf8');
+
+  console.log('\n  Wrote GitHub Actions workflow.');
+  console.log('  Next steps: commit the workflow and open a pull request to see scan comments.\n');
+
+  return { written: true, outputPath };
+}
+

package/templates/github-action-security.yml

@@ -5,6 +5,8 @@ on:
   push:
     branches: [main]
   schedule:
+    # Weekly full-project scan. The composite action automatically switches
+    # scheduled runs to full-project mode even when PRs use diff-only mode.
     - cron: "0 9 * * 1"
 
 permissions:
@@ -28,4 +30,3 @@ jobs:
           scan_packages: "true"
           scan_diff_only: "true"
           upload_sarif: "true"
-