agentaudit 3.5.0 → 3.6.0

package/cli.mjs

@@ -14,6 +14,7 @@
  */
 
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { createInterface } from 'readline';
@@ -573,15 +574,18 @@ async function scanRepo(url) {
   process.stdout.write(`${icons.scan}  Scanning ${c.bold}${slug}${c.reset} ${c.dim}...${c.reset}`);
   
   // Clone
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000,
       stdio: 'pipe',
     });
   } catch (err) {
     process.stdout.write(`  ${c.red}✖ clone failed${c.reset}\n`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -598,7 +602,7 @@ async function scanRepo(url) {
   const registryData = await checkRegistry(slug);
   
   // Cleanup
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   const duration = elapsed(start);
   
@@ -937,15 +941,18 @@ async function auditRepo(url) {
   
   // Step 1: Clone
   process.stdout.write(`  ${c.dim}[1/4]${c.reset} Cloning repository...`);
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   const repoPath = path.join(tmpDir, 'repo');
   try {
-    execSync(`git clone --depth 1 "${url}" "${repoPath}" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${url}" "${repoPath}"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     console.log(` ${c.green}done${c.reset}`);
-  } catch {
+  } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
+    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
     return null;
   }
   
@@ -985,6 +992,10 @@ async function auditRepo(url) {
     console.log(`  ${c.dim}$env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
     console.log(`  ${c.dim}$env:OPENAI_API_KEY = "sk-..."${c.reset}`);
     console.log();
+    console.log(`  ${c.dim}# Windows (CMD):${c.reset}`);
+    console.log(`  ${c.dim}set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+    console.log(`  ${c.dim}set OPENAI_API_KEY=sk-...${c.reset}`);
+    console.log();
     console.log(`  ${c.bold}Option 2: Export for manual review${c.reset}`);
     console.log(`  ${c.cyan}agentaudit audit ${url} --export${c.reset}`);
     console.log(`  ${c.dim}Creates a markdown file you can paste into any LLM (Claude, ChatGPT, etc.)${c.reset}`);
@@ -1023,7 +1034,7 @@ async function auditRepo(url) {
     }
     
     // Cleanup
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
@@ -1097,12 +1108,12 @@ async function auditRepo(url) {
   } catch (err) {
     console.log(` ${c.red}failed${c.reset}`);
     console.log(`  ${c.red}${err.message}${c.reset}`);
-    try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
     return null;
   }
   
   // Cleanup repo
-  try { execSync(`rm -rf "${tmpDir}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   if (!report) {
     console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
@@ -1189,6 +1200,11 @@ async function checkPackage(name) {
 async function main() {
   const args = process.argv.slice(2);
   
+  if (args[0] === '-v' || args[0] === '--version') {
+    console.log(`agentaudit ${getVersion()}`);
+    process.exit(0);
+  }
+  
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
     banner();
     console.log(`  ${c.bold}Commands:${c.reset}`);
@@ -1209,6 +1225,19 @@ async function main() {
     console.log(`    agentaudit audit https://github.com/owner/repo`);
     console.log(`    agentaudit check fastmcp`);
     console.log();
+    console.log(`  ${c.bold}For deep audits,${c.reset} set an LLM API key:`);
+    if (process.platform === 'win32') {
+      console.log(`    ${c.dim}PowerShell:  $env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
+      console.log(`    ${c.dim}CMD:         set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
+      console.log(`    ${c.dim}(or use OPENAI_API_KEY instead)${c.reset}`);
+    } else {
+      console.log(`    ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}    ${c.dim}(or OPENAI_API_KEY)${c.reset}`);
+    }
+    console.log();
+    console.log(`  ${c.bold}Or use as MCP server${c.reset} in Cursor/Claude ${c.dim}(no extra API key needed):${c.reset}`);
+    console.log(`    ${c.dim}Add to your MCP config:${c.reset}`);
+    console.log(`    ${c.dim}{ "agentaudit": { "command": "npx", "args": ["-y", "agentaudit"] } }${c.reset}`);
+    console.log();
     process.exit(0);
   }
   

package/index.mjs

@@ -25,6 +25,7 @@ import {
   ListToolsRequestSchema,
 } from '@modelcontextprotocol/sdk/types.js';
 import fs from 'fs';
+import os from 'os';
 import path from 'path';
 import { execSync } from 'child_process';
 import { fileURLToPath } from 'url';
@@ -124,9 +125,9 @@ function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0
 // ── Repo Helpers ────────────────────────────────────────
 
 function cloneRepo(sourceUrl) {
-  const tmpDir = fs.mkdtempSync('/tmp/agentaudit-');
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
   try {
-    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo" 2>/dev/null`, {
+    execSync(`git clone --depth 1 "${sourceUrl}" "${tmpDir}/repo"`, {
       timeout: 30_000, stdio: 'pipe',
     });
     return path.join(tmpDir, 'repo');
@@ -136,7 +137,7 @@ function cloneRepo(sourceUrl) {
 }
 
 function cleanupRepo(repoPath) {
-  try { execSync(`rm -rf "${path.dirname(repoPath)}"`, { stdio: 'pipe' }); } catch {}
+  try { fs.rmSync(path.dirname(repoPath), { recursive: true, force: true }); } catch {}
 }
 
 function slugFromUrl(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {