agentaudit 3.9.6 → 3.9.8

package/index.mjs

@@ -557,13 +557,36 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const data = await res.json();
         const risk = data.risk_score ?? data.latest_risk_score ?? 'unknown';
         const official = data.has_official_audit ? '✅ Officially audited' : 'Community audit';
+        const findings = data.total_findings ?? 0;
+        const maxSev = data.latest_max_severity;
+        const auditedAt = data.last_audited_at ? new Date(data.last_audited_at).toLocaleDateString('en-US', { year: 'numeric', month: 'short', day: 'numeric' }) : 'unknown';
+        const version = data.latest_known_version || null;
+        const isOutdated = data.is_outdated;
+
+        // Build response with risk assessment FIRST so the agent sees it immediately
+        let summary = '';
+
+        // Risk assessment at the very top — this is what the agent needs to act on
+        if (typeof risk === 'number' && risk >= 40) {
+          summary += `🚨 UNSAFE — DO NOT INSTALL WITHOUT WARNING THE USER!\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nYou MUST tell the user: "${package_name}" has been flagged as HIGH RISK in a security audit. It has ${findings} security finding(s) and a risk score of ${risk}/100. Installing this package is NOT recommended. Ask the user if they want to proceed despite the risk, and link them to the full report: ${REGISTRY_URL}/skills/${package_name}\n\n`;
+        } else if (typeof risk === 'number' && risk >= 20) {
+          summary += `⚠️ MODERATE RISK — Inform the user before installing.\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nTell the user: "${package_name}" has some security findings (risk ${risk}/100). Recommend they review the report before installing: ${REGISTRY_URL}/skills/${package_name}\n\n`;
+        } else if (typeof risk === 'number') {
+          summary += `✅ LOW RISK — Safe to install.\nRisk Score: ${risk}/100 | ${findings} finding(s)\n\nThis package has been audited and appears safe. You can proceed with installation.\n\n`;
+        }
+
+        if (isOutdated) {
+          summary += `⚠️ OUTDATED: The package has changed since the last audit. Consider running a fresh audit first.\n\n`;
+        }
 
-        let summary = `# ${package_name}\n\n`;
-        summary += `**Risk Score:** ${risk}/100\n`;
-        summary += `**Status:** ${official}\n`;
-        if (data.source_url) summary += `**Source:** ${data.source_url}\n`;
-        summary += `**Registry:** ${REGISTRY_URL}/skills/${package_name}\n\n`;
-        summary += `## Full Data\n\`\`\`json\n${JSON.stringify(data, null, 2)}\n\`\`\``;
+        // Details section
+        summary += `--- Details ---\n`;
+        summary += `Package: ${package_name}\n`;
+        summary += `Status: ${official}\n`;
+        summary += `Last Audited: ${auditedAt}\n`;
+        if (version) summary += `Audited Version: ${version}\n`;
+        if (data.source_url) summary += `Source: ${data.source_url}\n`;
+        summary += `Registry: ${REGISTRY_URL}/skills/${package_name}\n`;
 
         return { content: [{ type: 'text', text: summary }] };
       } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.6",
+  "version": "3.9.8",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {