agentaudit 3.9.15 → 3.9.16

package/cli.mjs

@@ -1309,15 +1309,17 @@ async function auditRepo(url) {
   // Check for API keys to determine which LLM to use
   const anthropicKey = process.env.ANTHROPIC_API_KEY;
   const openaiKey = process.env.OPENAI_API_KEY;
-  const activeProvider = anthropicKey ? 'Anthropic (Claude)' : openaiKey ? 'OpenAI (GPT-4o)' : null;
+  const openrouterKey = process.env.OPENROUTER_API_KEY;
+  const openrouterModel = process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+  const activeProvider = anthropicKey ? 'Anthropic (Claude)' : openaiKey ? 'OpenAI (GPT-4o)' : openrouterKey ? `OpenRouter (${openrouterModel})` : null;
   
-  if (!anthropicKey && !openaiKey) {
+  if (!anthropicKey && !openaiKey && !openrouterKey) {
     // No LLM API key — clear explanation
     console.log();
     console.log(`  ${c.yellow}No LLM API key found.${c.reset} The ${c.bold}audit${c.reset} command needs an LLM to analyze code.`);
     console.log();
     console.log(`  ${c.bold}Option 1: Set an API key${c.reset}`);
-    console.log(`  Supported keys: ${c.cyan}ANTHROPIC_API_KEY${c.reset} or ${c.cyan}OPENAI_API_KEY${c.reset}`);
+    console.log(`  Supported keys: ${c.cyan}ANTHROPIC_API_KEY${c.reset}, ${c.cyan}OPENAI_API_KEY${c.reset}, or ${c.cyan}OPENROUTER_API_KEY${c.reset}`);
     console.log();
     console.log(`  ${c.dim}# Linux / macOS:${c.reset}`);
     console.log(`  ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
@@ -1420,15 +1422,22 @@ async function auditRepo(url) {
       const text = data.content?.[0]?.text || '';
       _lastLlmText = text;
       report = extractJSON(text);
-    } else if (openaiKey) {
-      const res = await fetch('https://api.openai.com/v1/chat/completions', {
+    } else if (openaiKey || openrouterKey) {
+      const isOpenRouter = !openaiKey && !!openrouterKey;
+      const apiUrl = isOpenRouter ? 'https://openrouter.ai/api/v1/chat/completions' : 'https://api.openai.com/v1/chat/completions';
+      const apiToken = isOpenRouter ? openrouterKey : openaiKey;
+      const modelName = isOpenRouter ? (process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4') : 'gpt-4o';
+      const extraHeaders = isOpenRouter ? { 'HTTP-Referer': 'https://agentaudit.dev', 'X-Title': 'AgentAudit' } : {};
+
+      const res = await fetch(apiUrl, {
         method: 'POST',
         headers: {
-          'Authorization': `Bearer ${openaiKey}`,
+          'Authorization': `Bearer ${apiToken}`,
           'Content-Type': 'application/json',
+          ...extraHeaders,
         },
         body: JSON.stringify({
-          model: 'gpt-4o',
+          model: modelName,
           max_tokens: 8192,
           messages: [
             { role: 'system', content: systemPrompt },
@@ -1535,6 +1544,13 @@ async function checkPackage(name) {
   const data = await checkRegistry(name);
   if (!data) {
     if (!jsonMode) {
+      // If input looks like a URL, offer to auto-audit
+      if (name.includes('github.com') || name.includes('://')) {
+        console.log(`  ${c.yellow}Not found in registry.${c.reset}`);
+        console.log(`  ${c.dim}Starting audit for ${name}...${c.reset}`);
+        console.log();
+        return await auditRepo(name);
+      }
       console.log(`  ${c.yellow}Not found${c.reset} — package "${name}" hasn't been audited yet.`);
       console.log(`  ${c.dim}Run: agentaudit audit <repo-url> for a deep LLM audit${c.reset}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.15",
+  "version": "3.9.16",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {