appsec-agent 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/bin/agent-run.ts +94 -1
- package/conf/appsec_agent.yaml +3 -3
- package/dist/main.d.ts.map +1 -1
- package/dist/main.js.map +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -6,7 +6,7 @@ A TypeScript package that provides AI-powered agents for Application Security (A
|
|
|
6
6
|
|
|
7
7
|
## 🚀 Features
|
|
8
8
|
|
|
9
|
-
- **AI-Powered AppSec Automation**: Leverage Claude's capabilities for security
|
|
9
|
+
- **AI-Powered AppSec Automation**: Leverage Claude's capabilities for application security
|
|
10
10
|
- **Multiple Agent Types**: Simple query agent, code review agent, and threat modeler for different use cases
|
|
11
11
|
- **Tool Permission Management**: Advanced tool permission callbacks with bypass mode for trusted operations
|
|
12
12
|
- **Code Review Capabilities**: Automated security and privacy issue detection in code
|
package/bin/agent-run.ts
CHANGED
|
@@ -1 +1,94 @@
|
|
|
1
|
-
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
/**
|
|
3
|
+
* CLI script for AppSec AI Agent
|
|
4
|
+
*
|
|
5
|
+
* Author: Sam Li
|
|
6
|
+
*/
|
|
7
|
+
|
|
8
|
+
import * as path from 'path';
|
|
9
|
+
import * as fs from 'fs';
|
|
10
|
+
import { Command } from 'commander';
|
|
11
|
+
|
|
12
|
+
// Check if we're running from source or compiled
|
|
13
|
+
const isCompiled = fs.existsSync(path.join(__dirname, '..', 'dist'));
|
|
14
|
+
const basePath = isCompiled ? '../dist' : '../src';
|
|
15
|
+
|
|
16
|
+
// Use require for CommonJS compatibility
|
|
17
|
+
const { loadYaml, listRoles, printVersionInfo, getProjectRoot } = require(path.join(__dirname, basePath, 'utils'));
|
|
18
|
+
const { main } = require(path.join(__dirname, basePath, 'main'));
|
|
19
|
+
|
|
20
|
+
const program = new Command();
|
|
21
|
+
|
|
22
|
+
program
|
|
23
|
+
.name('agent-run')
|
|
24
|
+
.description('Automate the AppSec AI Agent dispatch')
|
|
25
|
+
.option('-y, --yaml <file>', 'Yaml configuration file - default to "appsec_agent.yaml" in the conf directory')
|
|
26
|
+
.option('-e, --environment <env>', 'Program running environment - default to "development"', 'development')
|
|
27
|
+
.option('-r, --role <role>', 'AppSec AI Agent role, refer to "appsec_agent.yaml" for available roles - default to "simple_query_agent"', 'simple_query_agent')
|
|
28
|
+
.option('-s, --src_dir <dir>', 'Project source code directory for code review agent - default to "src"')
|
|
29
|
+
.option('-o, --output_file <file>', 'Output file - default to "code_review_report.md"', 'code_review_report.md')
|
|
30
|
+
.option('-f, --output_format <format>', 'Output format - default to "markdown"', 'markdown')
|
|
31
|
+
.option('-k, --anthropic-api-key <key>', 'Anthropic API key (overrides ANTHROPIC_API_KEY environment variable)')
|
|
32
|
+
.option('-u, --anthropic-base-url <url>', 'Anthropic API base URL (overrides ANTHROPIC_BASE_URL environment variable)')
|
|
33
|
+
.option('-l, --list_roles', 'List all available roles')
|
|
34
|
+
.option('-v, --version', 'Program version')
|
|
35
|
+
.option('-V, --verbose', 'Verbose mode');
|
|
36
|
+
|
|
37
|
+
program.parse();
|
|
38
|
+
|
|
39
|
+
const options = program.opts();
|
|
40
|
+
|
|
41
|
+
// Handle version flag
|
|
42
|
+
if (options.version) {
|
|
43
|
+
printVersionInfo();
|
|
44
|
+
process.exit(0);
|
|
45
|
+
}
|
|
46
|
+
|
|
47
|
+
// Set default yaml configuration file
|
|
48
|
+
const yamlFile = options.yaml || path.join(getProjectRoot(), 'conf', 'appsec_agent.yaml');
|
|
49
|
+
|
|
50
|
+
console.log('Reading AppSec AI agent configuration file:', yamlFile);
|
|
51
|
+
const confDict = loadYaml(yamlFile, options.verbose);
|
|
52
|
+
|
|
53
|
+
if (!confDict) {
|
|
54
|
+
console.error('Failed to load configuration file');
|
|
55
|
+
process.exit(1);
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
console.log('AppSec AI agent configuration file read successfully');
|
|
59
|
+
|
|
60
|
+
// Handle list roles flag
|
|
61
|
+
if (options.list_roles) {
|
|
62
|
+
console.log('Listing all available AppSec AI agent roles');
|
|
63
|
+
listRoles(confDict, options.environment);
|
|
64
|
+
process.exit(0);
|
|
65
|
+
}
|
|
66
|
+
|
|
67
|
+
// Set Anthropic API environment variables if provided via command line
|
|
68
|
+
// SECURITY WARNING: Passing API keys via command line is insecure as they may be visible
|
|
69
|
+
// in process lists and shell history. Prefer using environment variables.
|
|
70
|
+
if (options.anthropicApiKey) {
|
|
71
|
+
console.warn('⚠️ SECURITY WARNING: API key provided via command line argument.');
|
|
72
|
+
console.warn(' Command-line arguments may be visible in process lists and shell history.');
|
|
73
|
+
console.warn(' For better security, use the ANTHROPIC_API_KEY environment variable instead.\n');
|
|
74
|
+
process.env.ANTHROPIC_API_KEY = options.anthropicApiKey;
|
|
75
|
+
}
|
|
76
|
+
if (options.anthropicBaseUrl) {
|
|
77
|
+
process.env.ANTHROPIC_BASE_URL = options.anthropicBaseUrl;
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
// Prepare args
|
|
81
|
+
const args = {
|
|
82
|
+
role: options.role,
|
|
83
|
+
environment: options.environment,
|
|
84
|
+
src_dir: options.src_dir,
|
|
85
|
+
output_file: options.output_file,
|
|
86
|
+
output_format: options.output_format,
|
|
87
|
+
verbose: options.verbose
|
|
88
|
+
};
|
|
89
|
+
|
|
90
|
+
// Run main function
|
|
91
|
+
main(confDict, args).catch((error) => {
|
|
92
|
+
console.error('Error running agent:', error);
|
|
93
|
+
process.exit(1);
|
|
94
|
+
});
|
package/conf/appsec_agent.yaml
CHANGED
|
@@ -6,18 +6,18 @@
|
|
|
6
6
|
default: &default
|
|
7
7
|
simple_query_agent:
|
|
8
8
|
options:
|
|
9
|
-
system_prompt: "You are an AppSec expert assistant. You are responsible for providing security advice and guidance to the user."
|
|
9
|
+
system_prompt: "You are an Application Security (AppSec) expert assistant. You are responsible for providing security advice and guidance to the user."
|
|
10
10
|
max_turns: 100
|
|
11
11
|
output_format: "stdout"
|
|
12
12
|
verbose: True
|
|
13
13
|
code_reviewer:
|
|
14
14
|
options:
|
|
15
|
-
system_prompt: "You are an AppSec expert assistant. You are responsible for performing a thorough code review. List out all the potential security and privacy issues found in the code. Then provide security and privacy advice and guidance in the code review report."
|
|
15
|
+
system_prompt: "You are an Application Security (AppSec) expert assistant. You are responsible for performing a thorough code review. List out all the potential security and privacy issues found in the code. Then provide security and privacy advice and guidance in the code review report."
|
|
16
16
|
output_format: "markdown"
|
|
17
17
|
verbose: True
|
|
18
18
|
threat_modeler:
|
|
19
19
|
options:
|
|
20
|
-
system_prompt: "You are an AppSec expert assistant. You are responsible for performing risk assessment on the source code repository for SOC2 type 2 compliance audit: Start with drawing the ASCII text based Data Flow Diagrm (DFD), with output format as <codebase_data_flow_diagram_text_timestamp>; then proceeding to use STRIDE methodology to perform threat modeling on the DFD, without output report in the format <codebase_threat_model_timestamp>; finally, provide a seperate risk registry report including proposed remediation plan in the format <codebase_risk_registry_text_timestamp>. We're looking for 3 reports in the current working directory as the deliverable."
|
|
20
|
+
system_prompt: "You are an Application Security (AppSec) expert assistant. You are responsible for performing risk assessment on the source code repository for SOC2 type 2 compliance audit: 1. Start with drawing the ASCII text based Data Flow Diagrm (DFD), with output format as <codebase_data_flow_diagram_text_timestamp>; 2. then proceeding to use STRIDE methodology to perform threat modeling on the DFD, without output report in the format <codebase_threat_model_timestamp>; 3. finally, provide a seperate risk registry report including proposed remediation plan in the format <codebase_risk_registry_text_timestamp>. We're looking for 3 reports in the current working directory as the deliverable."
|
|
21
21
|
output_format: "markdown"
|
|
22
22
|
verbose: True
|
|
23
23
|
|
package/dist/main.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;GAIG;
|
|
1
|
+
{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAgB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG1D,wBAAsB,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA2JxE"}
|
package/dist/main.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMH,oBA2JC;AA/JD,6CAA+B;AAC/B,mDAA0D;AAC1D,mCAA2F;AAEpF,KAAK,UAAU,IAAI,CAAC,QAAa,EAAE,IAAe;IACvD,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,4BAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAExD,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,iCAAiC;YACjC,IAAI,CAAC,IAAA,6BAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,yCAAyC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,SAAS,GAAG,IAAA,yBAAiB,EAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,oEAAoE;YACpE,MAAM,UAAU,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;gBACvD,EAAE,CAAC,QAAQ,CAAC,qDAAqD,EAAE,CAAC,MAAc,EAAE,EAAE;oBACpF,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,yBAAyB;YACzB,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBACtD,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM;YACR,CAAC;YAED,qBAAqB;YACrB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,mDAAmD;YACnD,kEAAkE;YAClE,MAAM,YAAY,CAAC,4BAA4B,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAEvE,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,mDAAmD,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAEzC,4BAA4B;QAC5B,MAAM,mBAAmB,GAAG,IAAA,8BAAsB,EAAC,IAAI,CAAC,WAAW,IAAI,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QACnH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,sHAAsH,CAAC,CAAC;YACtI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAAkB,CAAC;QACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,iCAAiC;YACjC,IAAI,CAAC,IAAA,6BAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,yCAAyC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,SAAS,GAAG,IAAA,yBAAiB,EAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,UAAU,GAAG,oDAAoD,SAAS,iIAAiI,mBAAmB,4CAA4C,IAAI,CAAC,aAAa,UAAU,CAAC;QACzS,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,iLAAiL,mBAAmB,4CAA4C,IAAI,CAAC,aAAa,UAAU,CAAC;QAC5R,CAAC;QAED,MAAM,YAAY,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAEvD,6DAA6D;QAC7D,IAAI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,mDAAmD,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAEtC,4BAA4B;QAC5B,MAAM,mBAAmB,GAAG,IAAA,8BAAsB,EAAC,IAAI,CAAC,WAAW,IAAI,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACpH,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,sHAAsH,CAAC,CAAC;YACtI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,4hBAA4hB,mBAAmB,4CAA4C,IAAI,CAAC,aAAa,UAAU,CAAC;QAE5oB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,UAAkB,CAAC;QAEvB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,iCAAiC;YACjC,IAAI,CAAC,IAAA,6BAAqB,EAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,KAAK,CAAC,yCAAyC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,SAAS,GAAG,IAAA,yBAAiB,EAAC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,UAAU,GAAG,0BAA0B,SAAS,eAAe,WAAW,EAAE,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,qDAAqD,WAAW,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,YAAY,CAAC,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAE7D,2CAA2C;QAC3C,IAAI,SAAS,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,mDAAmD,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,wCAAwC,IAAI,CAAC,IAAI,qDAAqD,CAAC,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "appsec-agent",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "TypeScript package for AppSec AI Agent management",
|
|
5
5
|
"author": "Sam Li",
|
|
6
|
+
"date": "Dec 13 2025",
|
|
6
7
|
"license": "MIT",
|
|
7
8
|
"main": "dist/index.js",
|
|
8
9
|
"types": "dist/index.d.ts",
|