agentverify 1.4.0 → 2.0.0

package/CHANGELOG.md

@@ -2,7 +2,40 @@
 
 All notable changes to the `agentverify` CLI/SDK package are documented here.
 
-## [1.4.0] - Unreleased
+## [2.0.0] - 2026-10-30
+
+### Added
+
+- `agentverify mcp`: run Agent Verify as an MCP server (stdio) for Claude Code, Cursor, Windsurf and VS Code.
+  Tools: `scan_path`, `scan_code`, `scan_mcp_config`. Reads `AGENTVERIFY_API_KEY`.
+  `claude mcp add agentverify -e AGENTVERIFY_API_KEY=av_your_key -- npx -y agentverify mcp`
+- Folder scans from the MCP server are combined into one report (60 files / 5MB, agent files first, tests last) and
+  each finding is mapped back to its file and line.
+- MCP config checks read only the server definitions and mask secret values locally before sending.
+- `Finding.line` is now part of the SDK type.
+- `agentverify/guard`: Agent Guard runtime protection (`createGuard`, `wrap`, `wrapAll`, `GuardBlockedError`).
+
+## [1.6.0] - 2026-10-27
+
+### Added
+
+- Scans now run Agent Verify's v1.6 check set (76 checks, up from 44), including framework packs
+  and MCP configuration checks — no CLI change needed;
+  results come from the API. See the root CHANGELOG for the full list.
+- Directory scans now also pick up `.jsx`, `.tsx`, `.toml`, and `.sh` files.
+
+## [1.5.0] - 2026-09-22
+
+### Added
+
+- `--profile <id>` — assess a directory against an assessment profile instead of running the
+  standard scan/verify flow. `owasp-agentic-skills-2026` is the first supported profile
+  (assessment schema `1.1.0`, currently alpha): `agentverify scan <dir> --profile owasp-agentic-skills-2026 --key av_your_key`.
+  Prints AST02/AST03/AST04 evidence-based results (`EVIDENCE_OBSERVED` / `GAP_IDENTIFIED`) plus
+  every other control explicitly as `NOT_ASSESSED`; `--json` prints the service's response
+  unmodified.
+
+## [1.4.0] - Shipped
 
 ### Changed — CI exit codes now distinguish a security failure from an execution error (behavior change)
 

package/README.md

@@ -116,7 +116,7 @@ The workflow requires a valid `AGENTVERIFY_API_KEY`. The local Worker code path
 
 Saved CLI reports sync to the dashboard through the API `cliReports` save path. If the API cannot save the report, the CLI still prints local scan output and tells you dashboard sync did not complete.
 
-Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action (`AI-Blockchain-Ventures/agentverify@v1`) already exists and produces text/Markdown/JSON output plus an optional workflow artifact — see below. Automatically posting that output as a PR comment (rather than just producing it for you to post) is still a planned enhancement, not yet built.
+Verified reports can expose a README badge from the report page. A packaged Agent Verify GitHub Action (`AI-Blockchain-Ventures/agentverify@v1.4.0`) already exists and produces text/Markdown/JSON output plus an optional workflow artifact — see below. Automatically posting that output as a PR comment (rather than just producing it for you to post) is still a planned enhancement, not yet built.
 
 See the full GitHub Action guide at `docs/github-action.md` for composite action inputs, JSON/Markdown examples, branch protection, optional PR comments, and badge guidance.