agentaudit 3.0.0 → 3.2.0

package/README.md

@@ -169,22 +169,41 @@ The MCP server finds credentials automatically from:
 ## CLI Reference
 
 ```
-agentaudit setup                            Register + configure API key
-agentaudit scan <url> [url...]              Scan Git repositories
+agentaudit discover                         Find local MCP servers + check registry
+agentaudit scan <url> [url...]              Quick static scan (regex, ~2s)
+agentaudit audit <url> [url...]             Deep LLM-powered audit (~30s)
 agentaudit check <name>                     Look up package in registry
-agentaudit --help                           Show help
+agentaudit setup                            Register + configure API key
 ```
 
+### `scan` vs `audit`
+
+| | `scan` | `audit` |
+|--|--------|---------|
+| **How** | Regex-based static analysis | LLM 3-pass analysis (UNDERSTAND → DETECT → CLASSIFY) |
+| **Speed** | ~2 seconds | ~30 seconds |
+| **Depth** | Pattern matching | Semantic code understanding |
+| **Needs API key** | No | Yes (`ANTHROPIC_API_KEY` or `OPENAI_API_KEY`) |
+| **Upload to registry** | No | Yes (with `agentaudit setup`) |
+
+Use `scan` for quick checks, `audit` for thorough analysis.
+
 ### Examples
 
 ```bash
-# Scan a single repo
+# Discover all MCP servers on your machine
+agentaudit discover
+
+# Quick scan
 agentaudit scan https://github.com/jlowin/fastmcp
 
-# Scan multiple repos at once
-agentaudit scan https://github.com/owner/repo1 https://github.com/owner/repo2
+# Deep audit (requires ANTHROPIC_API_KEY or OPENAI_API_KEY)
+agentaudit audit https://github.com/jlowin/fastmcp
+
+# Export audit for manual LLM review (no API key needed)
+agentaudit audit https://github.com/owner/repo --export
 
-# Check registry for existing audit
+# Check registry
 agentaudit check mongodb-mcp-server
 ```
 

package/cli.mjs

@@ -602,6 +602,440 @@ async function scanRepo(url) {
   return { slug, url, info, files: files.length, findings, registryData, duration };
 }
 
+// ── Discover local MCP configs ──────────────────────────
+
+function findMcpConfigs() {
+  const home = process.env.HOME || process.env.USERPROFILE || '';
+  const platform = process.platform;
+  
+  // All known MCP config locations
+  const candidates = [
+    // Claude Desktop
+    { name: 'Claude Desktop', path: path.join(home, '.claude', 'mcp.json') },
+    { name: 'Claude Desktop', path: path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json') },
+    { name: 'Claude Desktop', path: path.join(home, 'AppData', 'Roaming', 'Claude', 'claude_desktop_config.json') },
+    { name: 'Claude Desktop', path: path.join(home, '.config', 'claude', 'claude_desktop_config.json') },
+    // Cursor
+    { name: 'Cursor', path: path.join(home, '.cursor', 'mcp.json') },
+    // Windsurf / Codeium
+    { name: 'Windsurf', path: path.join(home, '.codeium', 'windsurf', 'mcp_config.json') },
+    // VS Code
+    { name: 'VS Code', path: path.join(home, '.vscode', 'mcp.json') },
+    // Continue.dev
+    { name: 'Continue', path: path.join(home, '.continue', 'config.json') },
+  ];
+  
+  // Also scan workspace .cursor/mcp.json, .vscode/mcp.json in cwd
+  const cwd = process.cwd();
+  candidates.push(
+    { name: 'Cursor (project)', path: path.join(cwd, '.cursor', 'mcp.json') },
+    { name: 'VS Code (project)', path: path.join(cwd, '.vscode', 'mcp.json') },
+  );
+  
+  const found = [];
+  for (const c of candidates) {
+    if (fs.existsSync(c.path)) {
+      try {
+        const content = JSON.parse(fs.readFileSync(c.path, 'utf8'));
+        found.push({ ...c, content });
+      } catch {}
+    }
+  }
+  return found;
+}
+
+function extractServersFromConfig(config) {
+  // Handle both { mcpServers: {...} } and { servers: {...} } formats
+  const servers = config.mcpServers || config.servers || {};
+  const result = [];
+  
+  for (const [name, serverConfig] of Object.entries(servers)) {
+    const info = {
+      name,
+      command: serverConfig.command || null,
+      args: serverConfig.args || [],
+      url: serverConfig.url || null,
+      sourceUrl: null,
+    };
+    
+    // Try to extract source URL from args (common patterns)
+    const allArgs = [info.command, ...info.args].filter(Boolean).join(' ');
+    
+    // npx package-name → npm package
+    const npxMatch = allArgs.match(/npx\s+(?:-y\s+)?(@?[a-z0-9][\w./-]*)/i);
+    if (npxMatch) info.npmPackage = npxMatch[1];
+    
+    // node /path/to/something → try to find package.json
+    const nodePathMatch = allArgs.match(/node\s+["']?([^"'\s]+)/);
+    if (nodePathMatch) {
+      const scriptPath = nodePathMatch[1];
+      // Walk up to find package.json with repository
+      let dir = path.dirname(path.resolve(scriptPath));
+      for (let i = 0; i < 5; i++) {
+        const pkgPath = path.join(dir, 'package.json');
+        if (fs.existsSync(pkgPath)) {
+          try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            if (pkg.repository?.url) {
+              info.sourceUrl = pkg.repository.url.replace(/^git\+/, '').replace(/\.git$/, '');
+            }
+            if (pkg.name) info.npmPackage = pkg.name;
+          } catch {}
+          break;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+      }
+    }
+    
+    // python/uvx with package name
+    const pyMatch = allArgs.match(/(?:uvx|pip run|python -m)\s+(@?[a-z0-9][\w./-]*)/i);
+    if (pyMatch) info.pyPackage = pyMatch[1];
+    
+    result.push(info);
+  }
+  return result;
+}
+
+function serverSlug(server) {
+  // Try to derive a slug for registry lookup
+  if (server.npmPackage) return server.npmPackage.replace(/^@/, '').replace(/\//g, '-');
+  if (server.pyPackage) return server.pyPackage.replace(/[^a-z0-9-]/gi, '-');
+  return server.name.toLowerCase().replace(/[^a-z0-9-]/gi, '-');
+}
+
+async function discoverCommand() {
+  console.log(`  ${c.bold}Discovering local MCP servers...${c.reset}`);
+  console.log();
+  
+  const configs = findMcpConfigs();
+  
+  if (configs.length === 0) {
+    console.log(`  ${c.yellow}No MCP configurations found.${c.reset}`);
+    console.log(`  ${c.dim}Searched: Claude Desktop, Cursor, Windsurf, VS Code${c.reset}`);
+    console.log();
+    console.log(`  ${c.dim}MCP config locations:${c.reset}`);
+    console.log(`  ${c.dim}  Claude:   ~/.claude/mcp.json${c.reset}`);
+    console.log(`  ${c.dim}  Cursor:   ~/.cursor/mcp.json${c.reset}`);
+    console.log(`  ${c.dim}  Windsurf: ~/.codeium/windsurf/mcp_config.json${c.reset}`);
+    console.log(`  ${c.dim}  VS Code:  ~/.vscode/mcp.json${c.reset}`);
+    console.log();
+    return;
+  }
+  
+  let totalServers = 0;
+  let checkedServers = 0;
+  let auditedServers = 0;
+  let unauditedServers = 0;
+  
+  for (const config of configs) {
+    const servers = extractServersFromConfig(config.content);
+    const serverCount = servers.length;
+    totalServers += serverCount;
+    
+    const countLabel = serverCount === 0
+      ? `${c.dim}no servers${c.reset}`
+      : `found ${c.bold}${serverCount}${c.reset} server${serverCount > 1 ? 's' : ''}`;
+    
+    console.log(`${icons.bullet}  Scanning ${c.bold}${config.name}${c.reset}  ${c.dim}${config.path}${c.reset}    ${countLabel}`);
+    
+    if (serverCount === 0) {
+      console.log();
+      continue;
+    }
+    
+    console.log();
+    
+    for (let i = 0; i < servers.length; i++) {
+      const server = servers[i];
+      const isLast = i === servers.length - 1;
+      const branch = isLast ? icons.treeLast : icons.tree;
+      const pipe = isLast ? '   ' : `${icons.pipe}  `;
+      
+      const slug = serverSlug(server);
+      checkedServers++;
+      
+      // Registry lookup
+      const registryData = await checkRegistry(slug);
+      
+      // Also try with server name directly
+      let regData = registryData;
+      if (!regData && slug !== server.name.toLowerCase()) {
+        regData = await checkRegistry(server.name.toLowerCase());
+      }
+      
+      // Determine source display
+      let sourceLabel = '';
+      if (server.npmPackage) sourceLabel = `${c.dim}npm:${server.npmPackage}${c.reset}`;
+      else if (server.pyPackage) sourceLabel = `${c.dim}pip:${server.pyPackage}${c.reset}`;
+      else if (server.command) sourceLabel = `${c.dim}${[server.command, ...server.args.slice(0, 2)].join(' ')}${c.reset}`;
+      
+      if (regData) {
+        auditedServers++;
+        const riskScore = regData.risk_score ?? regData.latest_risk_score ?? 0;
+        const hasOfficial = regData.has_official_audit;
+        console.log(`${branch}  ${c.bold}${server.name}${c.reset}    ${sourceLabel}`);
+        console.log(`${pipe}  ${riskBadge(riskScore)} Risk ${riskScore}  ${hasOfficial ? `${c.green}✔ official${c.reset}  ` : ''}${c.dim}${REGISTRY_URL}/skills/${slug}${c.reset}`);
+      } else {
+        unauditedServers++;
+        console.log(`${branch}  ${c.bold}${server.name}${c.reset}    ${sourceLabel}`);
+        console.log(`${pipe}  ${c.yellow}⚠ not audited${c.reset}  ${c.dim}Run: agentaudit audit <source-url>${c.reset}`);
+      }
+      
+      if (server.sourceUrl) {
+        console.log(`${pipe}  ${c.dim}source: ${server.sourceUrl}${c.reset}`);
+      }
+    }
+    
+    console.log();
+  }
+  
+  // Summary
+  console.log(`${c.dim}${'─'.repeat(60)}${c.reset}`);
+  console.log(`  ${c.bold}Summary${c.reset}  ${totalServers} server${totalServers !== 1 ? 's' : ''} across ${configs.length} config${configs.length !== 1 ? 's' : ''}`);
+  console.log();
+  if (auditedServers > 0) console.log(`  ${icons.safe}  ${c.green}${auditedServers} audited${c.reset}`);
+  if (unauditedServers > 0) console.log(`  ${icons.caution}  ${c.yellow}${unauditedServers} not audited${c.reset}`);
+  console.log();
+  
+  if (unauditedServers > 0) {
+    console.log(`  ${c.dim}To audit unaudited servers, run:${c.reset}`);
+    console.log(`  ${c.cyan}agentaudit scan <github-url>${c.reset}`);
+    console.log();
+  }
+}
+
+// ── Audit command (deep LLM-powered) ────────────────────
+
+function loadAuditPrompt() {
+  const promptPath = path.join(SKILL_DIR, 'prompts', 'audit-prompt.md');
+  if (fs.existsSync(promptPath)) return fs.readFileSync(promptPath, 'utf8');
+  return null;
+}
+
+async function auditRepo(url) {
+  const start = Date.now();
+  const slug = slugFromUrl(url);
+  
+  console.log(`${icons.scan}  ${c.bold}Auditing ${slug}${c.reset}  ${c.dim}${url}${c.reset}`);
+  console.log(`${icons.pipe}  ${c.dim}Deep LLM-powered analysis (3-pass: UNDERSTAND → DETECT → CLASSIFY)${c.reset}`);
+  console.log();
+  
+  // Step 1: Clone
+  process.stdout.write(`  ${c.dim}[1/4]${c.reset} Cloning repository...`);
+  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const repoPath = path.join(tmpDir, 'repo');
+  try {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+      timeout: 30_000, stdio: 'pipe',
+    });
+    console.log(` ${c.green}done${c.reset}`);
+  } catch {
+    console.log(` ${c.red}failed${c.reset}`);
+    return null;
+  }
+  
+  // Step 2: Collect files
+  process.stdout.write(`  ${c.dim}[2/4]${c.reset} Collecting source files...`);
+  const files = collectFiles(repoPath);
+  console.log(` ${c.green}${files.length} files${c.reset}`);
+  
+  // Step 3: Build audit payload
+  process.stdout.write(`  ${c.dim}[3/4]${c.reset} Preparing audit payload...`);
+  const auditPrompt = loadAuditPrompt();
+  
+  let codeBlock = '';
+  for (const file of files) {
+    codeBlock += `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
+  }
+  console.log(` ${c.green}done${c.reset}`);
+  
+  // Step 4: LLM Analysis
+  // Check for API keys to determine which LLM to use
+  const anthropicKey = process.env.ANTHROPIC_API_KEY;
+  const openaiKey = process.env.OPENAI_API_KEY;
+  
+  if (!anthropicKey && !openaiKey) {
+    // No LLM API key — output the prepared audit for piping or MCP use
+    console.log();
+    console.log(`  ${c.yellow}No LLM API key found.${c.reset} To run the audit automatically, set one of:`);
+    console.log(`    ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+    console.log(`    ${c.dim}export OPENAI_API_KEY=sk-...${c.reset}`);
+    console.log();
+    console.log(`  ${c.bold}Alternatives:${c.reset}`);
+    console.log(`    ${c.dim}1.${c.reset} Use the MCP server in Claude/Cursor — your agent runs the audit automatically`);
+    console.log(`    ${c.dim}2.${c.reset} Export for manual review: ${c.cyan}agentaudit audit ${url} --export${c.reset}`);
+    console.log();
+    
+    // Check if --export flag
+    if (process.argv.includes('--export')) {
+      const exportPath = path.join(process.cwd(), `audit-${slug}.md`);
+      const exportContent = [
+        `# Security Audit: ${slug}`,
+        `**Source:** ${url}`,
+        `**Files:** ${files.length}`,
+        ``,
+        `## Audit Instructions`,
+        ``,
+        auditPrompt || '(audit prompt not found)',
+        ``,
+        `## Report Format`,
+        ``,
+        `After analysis, produce a JSON report:`,
+        '```json',
+        `{ "skill_slug": "${slug}", "source_url": "${url}", "risk_score": 0, "result": "safe", "findings": [] }`,
+        '```',
+        ``,
+        `## Source Code`,
+        ``,
+        codeBlock,
+      ].join('\n');
+      fs.writeFileSync(exportPath, exportContent);
+      console.log(`  ${icons.safe}  Exported to ${c.bold}${exportPath}${c.reset}`);
+      console.log(`  ${c.dim}Paste this into any LLM (Claude, ChatGPT, etc.) for analysis${c.reset}`);
+    }
+    
+    // Cleanup
+    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    return null;
+  }
+  
+  // We have an API key — run LLM audit
+  process.stdout.write(`  ${c.dim}[4/4]${c.reset} Running LLM analysis...`);
+  
+  const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';
+  const userMessage = [
+    `Audit this package: **${slug}** (${url})`,
+    ``,
+    `After analysis, respond with ONLY a JSON object (no markdown, no explanation):`,
+    '```',
+    `{ "skill_slug": "${slug}", "source_url": "${url}", "package_type": "<mcp-server|agent-skill|library|cli-tool>",`,
+    `  "risk_score": <0-100>, "result": "<safe|caution|unsafe>", "max_severity": "<none|low|medium|high|critical>",`,
+    `  "findings_count": <n>, "findings": [{ "id": "...", "title": "...", "severity": "...", "category": "...",`,
+    `  "description": "...", "file": "...", "line": <n>, "remediation": "...", "confidence": "...", "is_by_design": false }] }`,
+    '```',
+    ``,
+    `## Source Code`,
+    codeBlock,
+  ].join('\n');
+  
+  let report = null;
+  
+  try {
+    if (anthropicKey) {
+      const res = await fetch('https://api.anthropic.com/v1/messages', {
+        method: 'POST',
+        headers: {
+          'x-api-key': anthropicKey,
+          'anthropic-version': '2023-06-01',
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify({
+          model: 'claude-sonnet-4-20250514',
+          max_tokens: 8192,
+          system: systemPrompt,
+          messages: [{ role: 'user', content: userMessage }],
+        }),
+        signal: AbortSignal.timeout(120_000),
+      });
+      const data = await res.json();
+      const text = data.content?.[0]?.text || '';
+      // Extract JSON from response
+      const jsonMatch = text.match(/\{[\s\S]*\}/);
+      if (jsonMatch) report = JSON.parse(jsonMatch[0]);
+    } else if (openaiKey) {
+      const res = await fetch('https://api.openai.com/v1/chat/completions', {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${openaiKey}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          model: 'gpt-4o',
+          max_tokens: 8192,
+          messages: [
+            { role: 'system', content: systemPrompt },
+            { role: 'user', content: userMessage },
+          ],
+        }),
+        signal: AbortSignal.timeout(120_000),
+      });
+      const data = await res.json();
+      const text = data.choices?.[0]?.message?.content || '';
+      const jsonMatch = text.match(/\{[\s\S]*\}/);
+      if (jsonMatch) report = JSON.parse(jsonMatch[0]);
+    }
+    
+    console.log(` ${c.green}done${c.reset} ${c.dim}(${elapsed(start)})${c.reset}`);
+  } catch (err) {
+    console.log(` ${c.red}failed${c.reset}`);
+    console.log(`  ${c.red}${err.message}${c.reset}`);
+    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    return null;
+  }
+  
+  // Cleanup repo
+  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  
+  if (!report) {
+    console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
+    return null;
+  }
+  
+  // Display results
+  console.log();
+  const riskScore = report.risk_score || 0;
+  console.log(`  ${riskBadge(riskScore)} Risk ${riskScore}/100  ${c.bold}${report.result || 'unknown'}${c.reset}`);
+  console.log();
+  
+  if (report.findings && report.findings.length > 0) {
+    console.log(`  ${c.bold}Findings (${report.findings.length})${c.reset}`);
+    console.log();
+    for (const f of report.findings) {
+      const sc = severityColor(f.severity);
+      console.log(`  ${severityIcon(f.severity)} ${sc}${(f.severity || '').toUpperCase().padEnd(8)}${c.reset} ${f.title}`);
+      if (f.file) console.log(`    ${c.dim}${f.file}${f.line ? ':' + f.line : ''}${c.reset}`);
+      if (f.description) console.log(`    ${c.dim}${f.description.slice(0, 120)}${c.reset}`);
+      console.log();
+    }
+  } else {
+    console.log(`  ${c.green}No findings — package looks clean.${c.reset}`);
+    console.log();
+  }
+  
+  // Upload to registry
+  const creds = loadCredentials();
+  if (creds) {
+    process.stdout.write(`  Uploading report to registry...`);
+    try {
+      const res = await fetch(`${REGISTRY_URL}/api/reports`, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${creds.api_key}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(report),
+        signal: AbortSignal.timeout(15_000),
+      });
+      if (res.ok) {
+        const data = await res.json();
+        console.log(` ${c.green}done${c.reset}`);
+        console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${slug}${c.reset}`);
+      } else {
+        console.log(` ${c.yellow}failed (HTTP ${res.status})${c.reset}`);
+      }
+    } catch (err) {
+      console.log(` ${c.yellow}failed${c.reset}`);
+    }
+  } else {
+    console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to upload reports to the registry${c.reset}`);
+  }
+  
+  console.log();
+  return report;
+}
+
 // ── Check command ───────────────────────────────────────
 
 async function checkPackage(name) {
@@ -611,7 +1045,7 @@ async function checkPackage(name) {
   const data = await checkRegistry(name);
   if (!data) {
     console.log(`  ${c.yellow}Not found${c.reset} — package "${name}" hasn't been audited yet.`);
-    console.log(`  ${c.dim}Run: agentaudit scan <repo-url> to audit it${c.reset}`);
+    console.log(`  ${c.dim}Run: agentaudit audit <repo-url> for a deep LLM audit${c.reset}`);
     return;
   }
   
@@ -631,15 +1065,22 @@ async function main() {
   
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
     banner();
-    console.log(`  ${c.bold}Usage:${c.reset}`);
-    console.log(`    agentaudit setup                            Register + configure API key`);
-    console.log(`    agentaudit scan <repo-url> [repo-url...]    Scan repositories`);
-    console.log(`    agentaudit check <package-name>             Look up in registry`);
+    console.log(`  ${c.bold}Commands:${c.reset}`);
+    console.log();
+    console.log(`    ${c.cyan}agentaudit discover${c.reset}                         Find local MCP servers + check registry`);
+    console.log(`    ${c.cyan}agentaudit scan${c.reset} <url> [url...]               Quick static scan (regex, local)`);
+    console.log(`    ${c.cyan}agentaudit audit${c.reset} <url> [url...]              Deep LLM-powered security audit`);
+    console.log(`    ${c.cyan}agentaudit check${c.reset} <name>                      Look up package in registry`);
+    console.log(`    ${c.cyan}agentaudit setup${c.reset}                             Register + configure API key`);
+    console.log();
+    console.log(`  ${c.bold}scan${c.reset} vs ${c.bold}audit${c.reset}:`);
+    console.log(`    ${c.dim}scan  = fast regex-based static analysis (~2s)${c.reset}`);
+    console.log(`    ${c.dim}audit = deep LLM analysis with 3-pass methodology (~30s)${c.reset}`);
     console.log();
     console.log(`  ${c.bold}Examples:${c.reset}`);
-    console.log(`    agentaudit setup`);
+    console.log(`    agentaudit discover`);
     console.log(`    agentaudit scan https://github.com/owner/repo`);
-    console.log(`    agentaudit scan repo1.git repo2.git repo3.git`);
+    console.log(`    agentaudit audit https://github.com/owner/repo`);
     console.log(`    agentaudit check fastmcp`);
     console.log();
     process.exit(0);
@@ -655,6 +1096,11 @@ async function main() {
     return;
   }
   
+  if (command === 'discover') {
+    await discoverCommand();
+    return;
+  }
+  
   if (command === 'check') {
     if (targets.length === 0) {
       console.log(`  ${c.red}Error: package name required${c.reset}`);
@@ -667,6 +1113,8 @@ async function main() {
   if (command === 'scan') {
     if (targets.length === 0) {
       console.log(`  ${c.red}Error: at least one repository URL required${c.reset}`);
+      console.log(`  ${c.dim}Tip: use ${c.cyan}agentaudit discover${c.dim} to find & check locally installed MCP servers${c.reset}`);
+      console.log(`  ${c.dim}Tip: use ${c.cyan}agentaudit audit <url>${c.dim} for a deep LLM-powered audit${c.reset}`);
       process.exit(1);
     }
     
@@ -682,6 +1130,19 @@ async function main() {
     return;
   }
   
+  if (command === 'audit') {
+    const urls = targets.filter(t => !t.startsWith('--'));
+    if (urls.length === 0) {
+      console.log(`  ${c.red}Error: at least one repository URL required${c.reset}`);
+      process.exit(1);
+    }
+    
+    for (const url of urls) {
+      await auditRepo(url);
+    }
+    return;
+  }
+  
   console.log(`  ${c.red}Unknown command: ${command}${c.reset}`);
   console.log(`  ${c.dim}Run agentaudit --help for usage${c.reset}`);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {