break-anything 0.0.0-stage → 0.2.0

package/docs/launch.md

@@ -0,0 +1,70 @@
+# Launch kit
+
+Research-backed. Sources: Show HN title formula ([signals.sh](https://signals.sh/blog/show-hn-title-formulas)),
+star-spike patterns ([dev.to, 50 repos](https://dev.to/0012303/i-analyzed-50-github-repos-that-went-from-0-to-10k-stars-here-are-the-7-patterns-54o1)),
+launch-day data ([arXiv 2511.04453](https://arxiv.org/abs/2511.04453)).
+
+## The one-liner (use everywhere, unchanged)
+
+> **Break Anything** — you think your service is secure, but you've never looked at it the way an
+> attacker would. Point your coding agent at code you own; it finds what's genuinely exploitable,
+> proves it on your own build, and fixes it.
+
+Rule: lead with the fear/pain, not the feature. The hook is the awareness gap ("you never actually
+tested it"); the proof is reachability (an attacker only cares about what they can reach — so does
+Break Anything).
+
+## Timing
+
+Launch **Tuesday–Thursday, ~8–10am US Eastern**. Timing moves stars more than almost anything
+else; the "Show HN" tag itself adds nothing after controlling for timing and content.
+
+## Hacker News (the multiplier — 87% of 10K-star repos start here)
+
+**Title** (formula: `[Name] – [plain description]`; no caps, no `!`, no praise):
+
+```
+Show HN: Break Anything – an MCP that audits your own code the way an attacker would
+```
+
+**First comment** (this is where the story goes, not the title — personal story earns ~3× the
+upvotes of a dry description):
+
+> My app was "probably secure" — it shipped, it worked, nobody complained, so I never actually
+> tested it. That's most software. I built Break Anything to close that gap: point your coding
+> agent at code you own and it looks at it the way an attacker would. It's an MCP server + CLI
+> that orchestrates OSV, Trivy, gitleaks (Semgrep/ZAP next), ranks findings by reachability + EPSS
+> (an attacker only cares about what they can actually reach), builds a proof-of-concept against
+> your own build, and — when upstream has no fix — proposes a patch. Defensive, local,
+> authorized-targets-only. Companion project Patch Anything does the repair half. Honest about
+> limits: reachability is today a heuristic (is it imported), not yet full call-path proof.
+> Feedback welcome, especially on the reachability engine.
+
+## Cross-posts (same day → next day)
+
+- **r/netsec, r/programming** — lead with the reachability angle: "most SCA reports presence; this
+  reports what's actually reachable + a PoC on your own target."
+- **X / 即刻 thread** — beat 1: the 400-vs-3 pain. beat 2: the hero GIF. beat 3: find → prove →
+  fix. beat 4: companion Patch Anything. beat 5: repo + 10 demos.
+- **V2EX / 掘金** — 直给、不绕:标题「`npm audit` 报你 47 个漏洞,到底哪 3 个能真打穿你?」正文讲
+  可达性 + 自己靶子的 PoC + 上游不修时的自救,强调防御定位与「只打自己授权的目标」。
+- **Awesome lists** — submit a one-line PR to the relevant awesome-security / awesome-devsecops
+  lists. These are GitHub's long-tail search engine (steady stars for months).
+
+## Hero GIF
+
+The README's first asset. Current cut (`vhs demos/hero.tape`) tells the whole story in ~19s with
+plain-language captions: *12 vulns here — which actually reach me?* → the reachable ones →
+*a key I deleted is still in git* → *found, proven, fixed.* Keep it under ~20s. See
+[hero-gif.md](hero-gif.md).
+
+## Guardrails (don't skip)
+
+- **Never buy stars.** ~6M fake stars exist on GitHub and fake-star repos get flagged/banned;
+  a fake curve destroys the credibility a real launch builds.
+- README line 1 is the pain, not the feature. Install command visible without scrolling.
+- Every demo/screenshot uses a lab or your own host. Never a third party.
+- Respond to every early issue within 24h — even just an acknowledgment. It converts drive-by
+  visitors into stargazers.
+- Be honest about limits (reachability heuristic, roadmap vs shipped). Restraint reads as
+  credibility; overclaiming gets picked apart.

package/docs/mcp-tools.md

@@ -0,0 +1,205 @@
+# Tool catalog & MCP contracts
+
+Break Anything is one MCP interface over a deep arsenal of industry-standard scanners. The public
+MCP interface describes *what the agent wants to learn*; a provider decides *how* to answer. This
+page is the exhaustive catalog, organized by scan category.
+
+Legend: **✅ shipped (0.2.0: `deps_scan`, `secrets_scan`, `image_scan`, `sast_scan`)** · **🧭
+roadmap**. Dynamic (traffic-sending) tools are **off by default** and refuse any target not on the
+authorization allowlist.
+
+---
+
+## ✅ Supply chain & dependencies (SCA) — `deps_scan`
+
+| | |
+| --- | --- |
+| **Status** | ✅ shipped |
+| **Primary engine** | OSV.dev query API (built-in, no install) |
+| **Additional engines** | Trivy, Grype, pip-audit, govulncheck, cargo-audit, bundler-audit, `composer audit`, OWASP Dependency-Check |
+| **Ecosystems** | npm, PyPI, Composer (PHP), Go, Maven/Gradle, Cargo, RubyGems, NuGet |
+| **Intel overlay** | EPSS (exploit probability), CISA KEV (known-exploited), GitHub Advisory |
+| **SBOM** | Syft / CycloneDX generation + diff |
+| **Signal** | import-based reachability today; call-path reachability on the roadmap |
+| **MCP tool** | `deps_scan(path, reachability?)` |
+| **CLI** | `brk deps <path> [--json] [--no-reachability]` |
+
+## ✅ Secrets — `secrets_scan`
+
+| | |
+| --- | --- |
+| **Status** | ✅ shipped |
+| **Primary engine** | built-in pattern + entropy scanner |
+| **Additional engines** | Gitleaks, TruffleHog, detect-secrets |
+| **Scope** | working tree + full git history (`--history`) |
+| **Patterns** | AWS, GCP, Stripe, GitHub, GitLab, Slack, OpenAI, JWTs, private keys, generic assigned secrets |
+| **Extras** | redacted output; optional live-key validation (roadmap) |
+| **MCP tool** | `secrets_scan(path, history?)` |
+| **CLI** | `brk secrets <path> [--history] [--json]` |
+
+## ✅ Containers & images — `image_scan`
+
+| | |
+| --- | --- |
+| **Status** | ✅ shipped (requires Trivy) |
+| **Engines** | Trivy, Grype, Dockle (CIS best practices), Hadolint (Dockerfile lint) |
+| **Finds** | OS + app-layer CVEs, Dockerfile anti-patterns, secrets in layers |
+| **MCP tool** | `image_scan(ref)` |
+| **CLI** | `brk image <ref> [--json]` |
+
+---
+
+## ✅ Static code analysis (SAST) — `sast_scan`
+
+| | |
+| --- | --- |
+| **Status** | ✅ shipped (requires Semgrep) |
+| **Primary engine** | Semgrep (default ruleset `p/security-audit`) |
+| **Roadmap engines** | CodeQL, Bandit (Python), gosec (Go), Brakeman (Rails), Find-Sec-Bugs (Java), Psalm/PHPStan (PHP), njsscan (JS/TS), cppcheck (C/C++) |
+| **Finds** | injection, XSS, broken access control, insecure deserialization, path traversal, SSRF, weak crypto — each with file/line, CWE/OWASP tags, and the snippet |
+| **MCP tool** | `sast_scan(path, config?)` |
+| **CLI** | `brk sast <path> [--json] [--config=<ruleset>] [--top=N]` |
+
+## 🧭 Infrastructure as Code (IaC) — `iac_scan`
+
+| | |
+| --- | --- |
+| **Engines** | Checkov, tfsec, Terrascan, KICS, Kubescape, kube-bench, kubesec, Falco (runtime) |
+| **Targets** | Terraform, CloudFormation, Kubernetes/Helm, Dockerfile, ARM/Bicep, Ansible |
+| **Finds** | public buckets, open security groups, missing encryption, over-broad IAM, privileged containers |
+| **Planned tool** | `iac_scan(path, framework?)` |
+
+## 🧭 Cloud posture (CSPM) — `cloud_audit`
+
+| | |
+| --- | --- |
+| **Engines** | Prowler, ScoutSuite |
+| **Clouds** | AWS, GCP, Azure (your own accounts/credentials) |
+| **Finds** | CIS/PCI/SOC2 control failures, exposed resources, weak IAM |
+| **Planned tool** | `cloud_audit(provider, profile)` — **dynamic, off by default** |
+
+## 🧭 Running web apps (DAST) — `dast_scan`
+
+| | |
+| --- | --- |
+| **Engines** | OWASP ZAP, Nuclei, Nikto, Wapiti, sqlmap, ffuf, Katana, Dalfox, gobuster |
+| **Finds** | OWASP Top 10, injection, XSS, SSRF, auth/session flaws, missing headers, hidden content/params — with the triggering request |
+| **Planned tools** | `dast_scan(url, profile)`, `dast_nuclei(url, templates)` — **dynamic, off by default** |
+
+## 🧭 API security — `api_scan`
+
+| | |
+| --- | --- |
+| **Engines** | Schemathesis (OpenAPI property-testing/fuzzing), ZAP API scan, auth-matrix prober |
+| **Finds** | BOLA/IDOR, broken authentication, mass assignment, excessive data exposure (OWASP API Top 10) |
+| **Planned tools** | `api_idor_probe`, `api_authz_matrix`, `api_fuzz(openapi)` — **dynamic, off by default** |
+
+## 🧭 Attack surface & recon — `recon`
+
+| | |
+| --- | --- |
+| **Engines** | Nmap, Amass (OWASP), ProjectDiscovery suite (subfinder, httpx, naabu, dnsx, katana) |
+| **Finds** | forgotten subdomains, exposed services, open ports, tech fingerprint, TLS/cert config (testssl.sh, sslyze) |
+| **Planned tool** | `recon(domain)` — **dynamic, off by default, your own assets only** |
+
+## 🧭 Smart contracts (Web3) — `contract_scan`
+
+| | |
+| --- | --- |
+| **Engines** | Slither, Mythril, Echidna (fuzzing) |
+| **Finds** | reentrancy, integer overflow, access-control gaps, oracle manipulation |
+| **Planned tool** | `contract_scan(path)` |
+
+## 🧭 Mobile — `mobile_scan`
+
+| | |
+| --- | --- |
+| **Engines** | MobSF, APKiD, Semgrep mobile rules |
+| **Targets** | Android APK, iOS IPA |
+| **Finds** | insecure storage, hardcoded secrets, weak crypto, exported components |
+| **Planned tool** | `mobile_scan(path)` |
+
+## 🧭 Fuzzing — `fuzz`
+
+| | |
+| --- | --- |
+| **Engines** | AFL++, libFuzzer, Atheris (Python), Jazzer (Java), cargo-fuzz |
+| **Finds** | crashes, memory-safety bugs, panics — with a minimized reproducer |
+| **Planned tool** | `fuzz(target, harness)` — **dynamic, off by default** |
+
+## 🧭 Offensive / exploitation (authorized pentest) — `exploit_*`
+
+| | |
+| --- | --- |
+| **Scope** | **Authorized targets only.** Gated, **off by default**, requires written permission and an allowlist. |
+| **Engines** | Metasploit Framework, sqlmap, Hydra, Hashcat, BloodHound + Impacket (Active Directory), OpenVAS/Greenbone |
+| **Finds** | confirmed exploitability — turns a "reachable" finding into a proven one on a target you own |
+| **Planned tools** | `exploit_confirm(finding)`, `exploit_ad_path`, `exploit_cred_spray` — **dynamic, off by default** |
+
+> This family exists so Break Anything can *prove* exploitability like a pentester, not so it can
+> attack strangers. Every tool here refuses targets outside your authorization allowlist, and the
+> project declines contributions that weaponize it against systems you don't control.
+
+## 🧭 AI / LLM security — `llm_scan`
+
+| | |
+| --- | --- |
+| **Engines** | [Garak](https://github.com/NVIDIA/garak), prompt-injection + jailbreak probes |
+| **Targets** | your own models, agents, and MCP tool surfaces |
+| **Finds** | prompt injection, jailbreaks, training-data/secret leakage, unsafe tool exposure |
+| **Planned tool** | `llm_scan(endpoint)` — **dynamic, off by default** |
+
+## 🧭 Binary & artifact analysis — `binary_scan`
+
+| | |
+| --- | --- |
+| **Engines** | Ghidra, radare2/rizin, angr (symbolic execution) |
+| **Targets** | compiled binaries, firmware, packaged apps |
+| **Finds** | known-vulnerable bundled deps, memory-safety smells, hardcoded secrets (pairs with the REA companion) |
+| **Planned tool** | `binary_scan(path)` |
+
+## 🧭 Remediation & handoff — `fix_*`
+
+| | |
+| --- | --- |
+| **Finds** | n/a — produces fixes |
+| **Planned tools** | `fix_plan(from)`, `fix_suggest_patch(finding)`, `fix_mitigation(finding)`, `fix_handoff_patch_anything(finding)` |
+
+---
+
+## Authorization gates
+
+Dynamic families (`dast_*`, `api_*`, `recon`, `cloud_audit`, `fuzz`, `exploit_*`, `llm_scan`)
+require both:
+
+```bash
+export BRK_DYNAMIC_ENABLED=true
+export BRK_AUTHORIZED_TARGETS_JSON='["http://localhost:3000","https://staging.example.internal"]'
+```
+
+A dynamic tool refuses any target not present in `BRK_AUTHORIZED_TARGETS_JSON`. There is no flag
+that disables this check.
+
+## Evidence envelope
+
+Every tool returns a structured result:
+
+- `finding` — the weakness, with a stable ID
+- `provider` — which engine produced it (e.g. `osv`, `trivy`, `semgrep`, `zap`)
+- `exploitability` — `confirmed` | `reachable` | `present` | `not_reachable`, plus EPSS and KEV
+- `evidence` — file/line, data-flow, or the request/response that proves it
+- `remediation` — fix version, patch sketch, or mitigation
+- `limitations` — what this result does **not** establish
+
+## Manual MCP registration
+
+```json
+{
+  "mcpServers": {
+    "break-anything": {
+      "command": "npx",
+      "args": ["-y", "break-anything", "mcp"]
+    }
+  }
+}
+```

package/docs/readme/README_zh.md

@@ -0,0 +1,172 @@
+<div align="center">
+
+[English](../../README.md) · **简体中文**
+
+# Break Anything · 攻破一切
+
+### 你以为你的服务很安全。你从没站在攻击者的角度看过它。
+
+Break Anything 把你的编码 Agent 指向你自己的代码、应用和基础设施,**像攻击者一样**审视它们——挖出真正可被利用的那些、在你自己构建上证明给你看、再修掉。赶在别人先找到之前。
+
+*用攻击者的眼睛,看你自己的服务。*
+
+[![npm version](https://img.shields.io/badge/npm-break--anything-cb3837?style=flat-square)](https://www.npmjs.com/package/break-anything)
+[![MCP 工具目录](https://img.shields.io/badge/MCP-工具目录-5c4ee5?style=flat-square)](../mcp-tools.md)
+[![仅限授权目标](https://img.shields.io/badge/范围-仅限授权目标-d13438?style=flat-square)](../../DISCLAIMER.md)
+[![MIT license](https://img.shields.io/badge/license-MIT-f4c430?style=flat-square)](../../LICENSE)
+
+**[快速开始](#快速开始) · [凭什么不一样](#凭什么不一样) · [30 秒看懂](#30-秒看懂) · [军火库](#军火库) · [FAQ](#faq)**
+
+<code>npx break-anything setup</code>
+
+</div>
+
+> [!IMPORTANT]
+> Break Anything 只检测**你拥有、或已获得明确授权**的软件。每个 PoC 都只打你自己的靶子。
+> 它是防御工具,不是攻击框架,严禁指向任何第三方系统。
+
+<div align="center">
+
+<img src="../assets/hero.gif" alt="Break Anything" width="900" />
+
+</div>
+
+---
+
+"应该没事吧。" 上线了、能跑、没人投诉,于是你默认它是安全的。但"还没出事"从来不是一次安全检测。唯一诚实的检测,是像攻击者那样审视你自己的服务:哪个依赖是一扇敞开的门、哪把 key 还躺在 git 历史里、哪个接口在把别人的数据交出去。
+
+而且,安全没有终点。2026 年 10 月,一个未授权的高危 RCE 在 PHP 自己身上被挖了出来、藏了好几年(php2shell)——连撑起大半个互联网的语言都还在冒高危洞,你的应用凭什么没有。你每加一个依赖,攻击面就更大一圈,而且你补不完所有洞。所以只补攻击者*今天*真能够到的那几条。
+
+而且游戏规则刚变了:同样会写代码的 AI Agent,如今正被用来大规模地挖漏洞——攻击者手里也有。抢在他们前面,用同样的杠杆先找到你自己的洞。
+
+**Break Anything 把这双"攻击者的眼睛"交给你的编码 Agent**——一句话,只针对你拥有的软件:挖出真正可被利用的、在*你自己*构建上证明、连修复一起给你。全程本地,绝不指向任何你不拥有的东西。
+
+## 快速开始
+
+```bash
+npx break-anything setup
+```
+
+选 Agent、确认改动、重启。支持 Claude Code、Codex、Cursor、Gemini CLI、Windsurf,以及任何能跑本地 MCP 的客户端。然后直接说:
+
+```text
+用 Break Anything 扫这个项目。只给我代码里真正可达的漏洞,证明最严重的那条,给我修复方案。
+```
+
+想用终端?一行命令,今天就能跑:
+
+```bash
+npx -y break-anything deps ./              # 依赖 CVE,按可达性 + EPSS 排序
+npx -y break-anything secrets ./ --history # 工作区 + 完整 git 历史里的泄露密钥
+npx -y break-anything image my-svc:latest  # 容器镜像的 OS + 应用层 CVE
+npx -y break-anything sast ./src           # 静态代码分析(注入、越权、SSRF…)
+```
+
+## 凭什么不一样
+
+扫描器都能甩你一张清单。清单本身就是问题。Break Anything 做的是清单做不到的三件事:
+
+- **看可达性——它像攻击者一样思考。** 攻击者不会挨个去看你那 400 条理论 CVE,他们只冲那几条真能够到的。Break Anything 也一样:把 `confirmed`(已确认)→ `reachable`(可达)→ `present`(存在)→ `not-reachable`(不可达)分开。你从不调用的那个脆弱 `lodash` 是噪音;活代码路径上的那个才是发现。你分诊 3 条,不是 400 条。
+- **给证据,不给空话。** 不是甩一段 CVSS 描述,而是在*你自己*构建上跑出一个 PoC——那条能打穿它的具体输入或请求——把"理论上有洞"变成"这就是复现"。
+- **上游没了也给你修。** 维护者消失、没有修复版本?它给你一个补丁、一个锁版本、一层兼容 shim,或一个维护中的 fork,不让一个被遗弃的依赖变成你的事故。交给 [Patch Anything](#配套patch-anything) 还能直接出可合并的 PR。
+
+它不取代 OSV、Trivy、Semgrep、ZAP——而是把它们**编排**在一个 Agent 接口下,再做它们做不了的推理。
+
+## 30 秒看懂
+
+三个你会用到它的时刻,每个都是一句话丢给 Agent:
+
+| 这一刻 | 你问 | 它给你 |
+| --- | --- | --- |
+| **"某 CVE 在刷屏——我们中招没?"** | *"扫我依赖,只标可达的。"* | 3 条可达 CVE + 修复版本,而不是 400 行的墙 |
+| **"有人提交密钥了吗?"** | *"扫仓库和 git 历史里的密钥。"* | 泄露的 key、引入它的 commit、"去轮换别只删" |
+| **"用户 A 能读到用户 B 的数据吗?"** | *"查 /orders/:id 的越权。"* | 那个 IDOR,用两个账号在 localhost 上证明给你看 |
+
+## 你可以指给它什么
+
+你不用自己选模式。把手头的东西丢给它,它自动识别形态、路由到对应引擎。
+
+| 你给它 | 形态 | 对应类别 |
+| --- | --- | --- |
+| 一个仓库 / 源码目录 | 源码 / 技术栈 | 依赖、代码、密钥 |
+| 一个 lockfile(`package-lock.json`、`composer.lock`、`go.mod`…) | 依赖清单 | 依赖 |
+| 一个容器镜像 | 构建产物 | 容器 |
+| 一个 APK / IPA 或编译二进制 | 构建产物 | 移动、模糊测试 |
+| 一份 Terraform / Kubernetes / Dockerfile | 配置 | 基础设施配置 |
+| 一个运行中的网址或 API(你自己的) | 活体系统 | 运行应用、API |
+| 云账号凭据(你自己的) | 活体账号 | 云配置 |
+| git 历史 | 仓库元数据 | 密钥 |
+
+## 军火库
+
+按**扫描类别**组织(安全团队的通用语言),每类都编排真实流水线里在跑的工具。✅ 0.1.0 已发 · 🧭 路线图。
+
+### ✅ 今日已发
+
+- **依赖(SCA)** — 整棵依赖树的已知 CVE,按可达性 + EPSS 排序,带修复版本。引擎:[OSV](https://osv.dev)、[Trivy](https://github.com/aquasecurity/trivy)、[Grype](https://github.com/anchore/grype)、pip-audit、govulncheck、composer audit。覆盖 npm/PyPI/Composer/Go/Maven/Cargo/RubyGems/NuGet。
+- **密钥(Secrets)** — 工作区 + 完整 git 历史里的泄露 key/令牌/私钥,脱敏。引擎:[Gitleaks](https://github.com/gitleaks/gitleaks)、[TruffleHog](https://github.com/trufflesecurity/trufflehog)。
+- **容器镜像** — OS + 应用层 CVE、Dockerfile 坏味道、层里的密钥。引擎:[Trivy](https://github.com/aquasecurity/trivy)、[Grype](https://github.com/anchore/grype)、[Hadolint](https://github.com/hadolint/hadolint)。
+- **静态代码(SAST)** — 注入、越权、不安全反序列化、SSRF、硬编码密钥——每条带文件/行号、CWE/OWASP 标签和命中代码片段。引擎:[Semgrep](https://semgrep.dev)。
+
+### 🧭 路线图
+
+- **更多 SAST 引擎** — [CodeQL](https://codeql.github.com)、SonarQube CE、Bandit(Py)、gosec(Go)、Brakeman(Rails)、Find-Sec-Bugs(Java)、security-code-scan(.NET)、retire.js(前端 JS)。
+- **基础设施与 Kubernetes(IaC)** — `apply` 前揪出公开桶、开放端口、过宽 IAM、集群配置错误。[Checkov](https://www.checkov.io)、tfsec、Terrascan、[KICS](https://kics.io)、[Kubescape](https://github.com/kubescape/kubescape)、kube-bench、[Falco](https://falco.org)(运行时)。
+- **运行应用与攻击面(DAST)** — OWASP Top 10、目录/参数发现、XSS、注入,打你授权的应用。[OWASP ZAP](https://www.zaproxy.org)、[Nuclei](https://github.com/projectdiscovery/nuclei)、[Nikto](https://github.com/sullo/nikto)、[ffuf](https://github.com/ffuf/ffuf)、[Katana](https://github.com/projectdiscovery/katana)、[Dalfox](https://github.com/hahwul/dalfox)、[sqlmap](https://sqlmap.org);攻击面测绘用 [Nmap](https://nmap.org) + [Amass](https://github.com/owasp-amass/amass) + ProjectDiscovery。
+- **API** — 越权(IDOR/BOLA)、认证绕过、批量赋值(OWASP API Top 10)。[Schemathesis](https://github.com/schemathesis/schemathesis)、ZAP。
+- **进攻 / 漏洞利用** — *仅限授权渗透;默认关闭、需显式开启、须书面授权。* 在你拥有的目标上证明可利用性。[Metasploit](https://www.metasploit.com)、sqlmap、[Hydra](https://github.com/vanhauser-thc/thc-hydra)、[Hashcat](https://hashcat.net)、[BloodHound](https://github.com/SpecterOps/BloodHound) + Impacket(域渗透)、[OpenVAS](https://www.openvas.org)。
+- **AI / 大模型安全** — 对你自己的模型和 Agent 做提示注入、越狱、数据泄露检测。[Garak](https://github.com/NVIDIA/garak)。
+- **二进制与产物分析** — 编译二进制里的已知脆弱依赖和不安全模式。[Ghidra](https://ghidra-sre.org)、[radare2](https://github.com/radareorg/radare2)、[angr](https://github.com/angr/angr)(与 REA 互补)。
+- **云配置 · 智能合约 · 移动 · 模糊测试** — [Prowler](https://github.com/prowler-cloud/prowler) · [Slither](https://github.com/crytic/slither)、Mythril、Echidna · [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) · [AFL++](https://github.com/AFLplusplus/AFLplusplus)、libFuzzer、Jazzer。
+
+逐工具完整目录和 MCP 契约见 [docs/mcp-tools.md](../mcp-tools.md)。所有动态(发流量)类别**默认关闭**,拒绝任何不在白名单里的目标。
+
+## 工作原理
+
+Agent 通过 MCP 调用 Break Anything 检查一个你掌控的目标;它路由到对应引擎、确认可达性,每条结果带证据和修复返回。CLI 走同一套工作流。
+
+![Find Prove Fix 流程](../assets/break-flow.svg)
+
+**Find 找**(依赖/代码/密钥/镜像/IaC/运行应用里的弱点)→ **Prove 证**(对你的靶子生成 PoC 证明可达)→ **Fix 修**(直接修,或交给 Patch Anything)。"未发现"绝不等于"安全"。
+
+## 配套:Patch Anything
+
+> **Break Anything** 找出来、证明它 → **[Patch Anything](https://github.com/EnkiHQ/patch-anything)** 修掉它。
+
+把任意发现交给它,起草补丁、升级、shim 或 fork。发现与修复,一个闭环。
+
+## FAQ
+
+<details><summary><strong>和 npm audit / Trivy / Snyk 有什么不同?</strong></summary>
+
+它们报"存在"——依赖树里任何地方存在的每个漏洞。Break Anything 多了**可达性**(是否真被调用)、**证明**(对你自己构建的 PoC)、以及上游无修复时的**自救修复**,还把依赖/代码/密钥/镜像/IaC/运行时统一到一个 Agent 接口下。
+
+</details>
+
+<details><summary><strong>它取代这些工具吗?</strong></summary>
+
+不,它编排它们。Break Anything 是大脑和接口,OSV/Trivy/Semgrep/ZAP 是引擎。你拿到它们的深度,又不用逐个去学。
+
+</details>
+
+<details><summary><strong>这是攻击工具吗?会被下架吗?</strong></summary>
+
+不是。防御性、仅授权目标;每个 PoC 都打你自己的靶子,不含武器化 exploit。见 [DISCLAIMER.md](../../DISCLAIMER.md)。GitHub 政策明确支持双用途安全研究。
+
+</details>
+
+<details><summary><strong>会上传我的代码吗?</strong></summary>
+
+分析在本地。Agent 收到结果,其模型提供商有自己的数据政策,单独确认。
+
+</details>
+
+<details><summary><strong>哪些 Agent 能用?</strong></summary>
+
+任何支持本地 MCP server 的 Agent。Setup 自动配置常见的那几个。
+
+</details>
+
+## 许可
+
+[MIT](../../LICENSE)。Break 自身代码为 MIT;编排的引擎各自保留其许可证,见 [THIRD_PARTY_NOTICES.md](../../THIRD_PARTY_NOTICES.md)。

package/docs/roadmap.md

@@ -0,0 +1,51 @@
+# Roadmap
+
+Break Anything is growing from a dependency scanner into one agent-facing interface for finding,
+proving, and fixing weaknesses across the whole surface of a project you own. Roadmap items
+describe direction, not shipped support. A new scanner joins the public workflow only once it
+produces the same finding envelope (severity, evidence, exploitability, remediation, limitations)
+as the shipped scanners.
+
+## Shipped (0.2.0)
+
+- **Supply chain / dependencies (SCA)** — npm, Composer (PHP), pip; OSV lookup, import-based
+  reachability heuristic, EPSS, fix versions.
+- **Secrets** — working tree + git history, redacted output.
+- **Container images** — via Trivy.
+- **Static code (SAST)** — via Semgrep: injection, broken access control, deserialization, SSRF,
+  with CWE/OWASP tags and the offending snippet.
+- **MCP tools** — `deps_scan`, `secrets_scan`, `image_scan`, `sast_scan`.
+
+## Next
+
+- **More SAST engines** — CodeQL, Bandit (Python), gosec (Go), Brakeman (Rails), Find-Sec-Bugs
+  (Java), security-code-scan (.NET), retire.js (frontend) — broaden language/stack coverage.
+- **Exploitability engine** — upgrade reachability from "is it imported" to "is the vulnerable
+  symbol on a real call path", and rank with EPSS + CISA KEV.
+- **IaC** — Checkov / tfsec / Terrascan / KICS over Terraform, CloudFormation, Kubernetes/Helm,
+  Dockerfile.
+- **DAST (authorized)** — OWASP ZAP + Nuclei + Nikto against your own running app.
+
+## Later
+
+- **API security** — Schemathesis (OpenAPI fuzzing) + auth-matrix prober for BOLA/IDOR, broken
+  auth, mass assignment (OWASP API Top 10).
+- **Cloud posture (CSPM)** — Prowler / ScoutSuite against your own AWS/GCP/Azure accounts.
+- **Attack surface & recon** — Nmap + Amass + ProjectDiscovery (ffuf/Katana/Dalfox) over your own domains and hosts.
+- **Offensive / exploitation (authorized pentest)** — Metasploit, Hydra, Hashcat, BloodHound + Impacket, OpenVAS. Gated, off by default, written-permission-only; turns a "reachable" finding into a proven one.
+- **AI / LLM security** — Garak-backed prompt-injection, jailbreak, and data-leakage probes for your own models and agents.
+- **Binary & artifact analysis** — Ghidra / radare2 / angr for compiled binaries and firmware (pairs with REA).
+- **Smart contracts** — Slither / Mythril / Echidna for Solidity.
+- **Mobile** — MobSF for APK/IPA.
+- **Fuzzing** — AFL++ / libFuzzer / Jazzer / Atheris with minimized reproducers.
+- **Self-remediation** — when upstream has no fix: generate a patch, pin, compatibility shim, or
+  point to a maintained fork. Deep handoff to [Patch Anything](https://github.com/EnkiHQ/patch-anything).
+- **SBOM & evidence bundles** — generate/diff SBOMs (Syft) and portable, reproducible finding
+  records that survive across sessions and gate CI.
+
+## Principles
+
+- Defensive, authorized-targets-only. Dynamic capabilities stay off by default.
+- Orchestrate trusted tools; don't reinvent scanners.
+- Signal over noise: always separate "confirmed", "reachable", and "present".
+- Honesty: absence of a finding is never reported as proof of safety.

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "break-anything",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "One CLI and MCP server for coding agents to find vulnerabilities across code, dependencies, apps, and infrastructure — on targets you own or are authorized to test.",
+  "type": "module",
+  "keywords": [
+    "security",
+    "vulnerability",
+    "sast",
+    "sca",
+    "mcp",
+    "agent",
+    "cve",
+    "osv",
+    "reachability",
+    "appsec"
+  ],
+  "homepage": "https://github.com/EnkiHQ/break-anything#readme",
+  "bugs": {
+    "url": "https://github.com/EnkiHQ/break-anything/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/EnkiHQ/break-anything.git"
+  },
+  "author": "EnkiHQ",
+  "license": "MIT",
+  "bin": {
+    "brk": "bin/brk.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "docs",
+    "DISCLAIMER.md"
+  ],
+  "engines": {
+    "node": ">=18.17"
+  },
+  "scripts": {
+    "mcp": "node bin/brk.js mcp",
+    "test": "node --test"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/epss.js

@@ -0,0 +1,28 @@
+import { fetchJson } from "./http.js";
+
+// EPSS:给定一批 CVE,返回 { CVE -> { epss, percentile } }(尽力而为,失败则空)
+export async function enrichEpss(cves) {
+  const unique = [...new Set(cves.filter(Boolean))];
+  if (!unique.length) return new Map();
+  const out = new Map();
+  // FIRST.org 支持逗号分隔批量查询,分批避免 URL 过长
+  const batches = chunk(unique, 50);
+  for (const batch of batches) {
+    try {
+      const url = `https://api.first.org/data/v1/epss?cve=${encodeURIComponent(batch.join(","))}`;
+      const data = await fetchJson(url, { timeoutMs: 10000 });
+      for (const row of data.data || []) {
+        out.set(row.cve, { epss: Number(row.epss), percentile: Number(row.percentile) });
+      }
+    } catch {
+      // EPSS 是增益信息,拿不到就跳过,不影响主流程
+    }
+  }
+  return out;
+}
+
+function chunk(arr, n) {
+  const out = [];
+  for (let i = 0; i < arr.length; i += n) out.push(arr.slice(i, i + n));
+  return out;
+}

package/src/http.js

@@ -0,0 +1,44 @@
+// 带超时的 fetch 封装,所有外部请求都走这里
+export async function fetchJson(url, { method = "GET", body, timeoutMs = 15000, headers = {} } = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method,
+      signal: controller.signal,
+      headers: {
+        "accept": "application/json",
+        ...(body ? { "content-type": "application/json" } : {}),
+        "user-agent": "break-anything/0.1 (+https://github.com/EnkiHQ/break-anything)",
+        ...headers,
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      throw new Error(`HTTP ${res.status} ${res.statusText} for ${url}${text ? ` — ${text.slice(0, 200)}` : ""}`);
+    }
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// 简单并发池:对一组 item 以受限并发执行 worker,保序返回结果
+export async function mapPool(items, concurrency, worker) {
+  const results = new Array(items.length);
+  let next = 0;
+  const runners = new Array(Math.min(concurrency, items.length)).fill(0).map(async () => {
+    while (true) {
+      const i = next++;
+      if (i >= items.length) break;
+      try {
+        results[i] = await worker(items[i], i);
+      } catch (err) {
+        results[i] = { __error: err instanceof Error ? err.message : String(err) };
+      }
+    }
+  });
+  await Promise.all(runners);
+  return results;
+}