autoremediator 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +107 -4
- package/dist/chunk-H4ICCI3K.js +1847 -0
- package/dist/chunk-H4ICCI3K.js.map +1 -0
- package/dist/cli.d.ts +1 -0
- package/dist/cli.js +119 -0
- package/dist/cli.js.map +1 -0
- package/dist/index.d.ts +175 -0
- package/dist/index.js +19 -0
- package/dist/index.js.map +1 -0
- package/dist/mcp/server.d.ts +1 -0
- package/dist/mcp/server.js +80 -0
- package/dist/mcp/server.js.map +1 -0
- package/dist/openapi/server.d.ts +2 -0
- package/dist/openapi/server.js +236 -0
- package/dist/openapi/server.js.map +1 -0
- package/package.json +16 -3
package/README.md
CHANGED
|
@@ -1,6 +1,109 @@
|
|
|
1
|
-
#
|
|
1
|
+
# Autoremediator
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
[](https://www.npmjs.com/package/autoremediator)
|
|
4
|
+
[](https://www.npmjs.com/package/autoremediator)
|
|
5
|
+
[](https://github.com/Rawlings/autoremediator/blob/master/LICENSE)
|
|
6
|
+
[](https://www.npmjs.com/package/autoremediator)
|
|
4
7
|
|
|
5
|
-
|
|
6
|
-
|
|
8
|
+
Autoremediator is an agentic Node.js CVE remediation tool.
|
|
9
|
+
|
|
10
|
+
It can remediate from either a single CVE ID or scanner output, then apply safe dependency updates with package-manager-aware validation and fallback strategies.
|
|
11
|
+
|
|
12
|
+
- Scanner-first workflow with CVE fallback
|
|
13
|
+
- Package manager support: npm, pnpm, yarn
|
|
14
|
+
- Policy-driven safety controls
|
|
15
|
+
- Evidence logging and CI summary support
|
|
16
|
+
|
|
17
|
+
## For AI Agents
|
|
18
|
+
|
|
19
|
+
Autoremediator is useful in practical dependency-security workflows where teams need fixes, evidence, and CI-friendly behavior.
|
|
20
|
+
|
|
21
|
+
Common scenarios:
|
|
22
|
+
|
|
23
|
+
- Cleaning up npm audit or yarn audit results in active services.
|
|
24
|
+
- Triage and remediation of a specific CVE across one or many Node.js projects.
|
|
25
|
+
- Converting scanner outputs (including SARIF) into actionable dependency updates.
|
|
26
|
+
- Running non-interactive remediation in CI with deterministic summaries and exit codes.
|
|
27
|
+
- Powering internal security assistants through CLI, SDK, or MCP tool integration.
|
|
28
|
+
|
|
29
|
+
Primary surfaces:
|
|
30
|
+
|
|
31
|
+
- CLI: `autoremediator`
|
|
32
|
+
- MCP server: `autoremediator-mcp`
|
|
33
|
+
- SDK: `import { remediate, remediateFromScan } from "autoremediator"`
|
|
34
|
+
|
|
35
|
+
## Use Cases
|
|
36
|
+
|
|
37
|
+
- Auto-remediate npm audit findings in CI with deterministic exit codes.
|
|
38
|
+
- Process SARIF security scan output and apply safe dependency upgrades.
|
|
39
|
+
- Build an internal security bot on top of the MCP server tool surface.
|
|
40
|
+
- Integrate CVE-to-fix workflows into custom Node.js platform tooling.
|
|
41
|
+
- Run scanner-to-remediation pipelines across npm, pnpm, and yarn projects.
|
|
42
|
+
|
|
43
|
+
## Installation
|
|
44
|
+
|
|
45
|
+
Global:
|
|
46
|
+
|
|
47
|
+
```bash
|
|
48
|
+
pnpm add -g autoremediator
|
|
49
|
+
# or
|
|
50
|
+
npm install -g autoremediator
|
|
51
|
+
# or
|
|
52
|
+
yarn global add autoremediator
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
Project-local:
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
pnpm add -D autoremediator
|
|
59
|
+
pnpm exec autoremediator --help
|
|
60
|
+
```
|
|
61
|
+
|
|
62
|
+
## Environment
|
|
63
|
+
|
|
64
|
+
Set one provider key:
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
export OPENAI_API_KEY=...
|
|
68
|
+
# or
|
|
69
|
+
export ANTHROPIC_API_KEY=...
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
## Quick Start
|
|
73
|
+
|
|
74
|
+
Single CVE:
|
|
75
|
+
|
|
76
|
+
```bash
|
|
77
|
+
autoremediator CVE-2021-23337
|
|
78
|
+
autoremediator CVE-2021-23337 --dry-run
|
|
79
|
+
autoremediator CVE-2021-23337 --run-tests
|
|
80
|
+
autoremediator CVE-2021-23337 --llm-provider anthropic
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
Scanner input:
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
autoremediator ./audit.json
|
|
87
|
+
autoremediator ./report.sarif --format sarif
|
|
88
|
+
autoremediator --input ./scan.json --format auto
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
CI mode:
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
autoremediator ./scan.json --ci --summary-file ./summary.json
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
## Documentation
|
|
98
|
+
|
|
99
|
+
- Live docs site: https://rawlings.github.io/autoremediator/
|
|
100
|
+
- Repository: https://github.com/Rawlings/autoremediator
|
|
101
|
+
|
|
102
|
+
## Exit Codes (CI)
|
|
103
|
+
|
|
104
|
+
- `0` when failedCount is 0
|
|
105
|
+
- `1` when failedCount is greater than 0
|
|
106
|
+
|
|
107
|
+
## License
|
|
108
|
+
|
|
109
|
+
MIT
|