correctover-scan 1.1.0 → 1.2.1

package/README.md

@@ -82,10 +82,31 @@ Try the online version: [correctover.com/scan](https://correctover.com/scan/)
 - **OWASP AISVS 1.0** — AI System Vulnerability Severity
 - **GB/T《智能体应用安全基本要求》** — Chinese National Mandatory Standard
 
+## Free Tier
+
+50 scans/day — no credit card required.
+
+Unlock unlimited: [correctover.com/checkout](https://correctover.com/checkout)
+
+```bash
+export CORRECTOVER_LICENSE_KEY=your-key-here
+```
+
+## Related Correctover Tools
+
+| Tool | Install | Description |
+|------|---------|-------------|
+| **Security Scanner** | `npx correctover-scan` | MCP config security audit (14 checks) |
+| **Self-Healing Test** | `pip install correctover-test` | Agent self-healing test suite |
+| **Vulnerability Scan** | `pip install correctover-security-audit` | 215 fault type scanner |
+| **Compliance Check** | `pip install correctover-compliance-check` | OAuth 2.1 + CCS v1.0 |
+| **Runtime Guard** | `pip install correctover-runtime-guard` | 22µs RCE/SSRF interception |
+| **MCP Server** | `npm install correctover-mcp-server` | 6-dimension validation |
+
 ## Links
 
 - [correctover.com](https://correctover.com) — AI Agent Runtime Assurance
-- [CCS Standard](https://correctover.com/ccs) — Conformance Specification
+- [CCS Standard](https://correctover.com/ccs) — Conformance Specification (DOI: 10.5281/zenodo.21234580)
 - [Web Scanner](https://correctover.com/scan/) — Online version
 - [GitHub](https://github.com/Correctover) — Source code
 

package/core/license.js

@@ -0,0 +1,128 @@
+/**
+ * License validator for correctover-scan NPM.
+ * Mirrors the Python LicenseValidator: 50 free scans/day, CORRECTOVER_LICENSE_KEY unlocks.
+ * Supports CV-TRL/CV-PRO (FC) and COV- (Cloud) key formats.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const os = require('os');
+
+const FREE_LIMIT_PER_DAY = 50;
+const STATE_FILE = path.join(os.homedir(), '.correctover', 'license.json');
+
+function loadState() {
+  try {
+    if (fs.existsSync(STATE_FILE)) {
+      return JSON.parse(fs.readFileSync(STATE_FILE, 'utf-8'));
+    }
+  } catch (e) {}
+  return { products: {}, license_key: null, installed_at: Date.now() / 1000 };
+}
+
+function saveState(state) {
+  try {
+    fs.mkdirSync(path.dirname(STATE_FILE), { recursive: true });
+    fs.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+  } catch (e) {}
+}
+
+function getProductState(state, product) {
+  const today = new Date().toISOString().slice(0, 10);
+  if (!state.products[product]) {
+    state.products[product] = { calls_today: 0, date: today, total_calls: 0 };
+  }
+  if (state.products[product].date !== today) {
+    state.products[product].calls_today = 0;
+    state.products[product].date = today;
+  }
+  return state.products[product];
+}
+
+function verifyLicenseKey(key) {
+  if (!key || key.length < 12) return false;
+
+  // COV-<product>-<hash> (Cloud HMAC)
+  if (key.startsWith('COV-')) {
+    const parts = key.split('-');
+    if (parts.length < 3) return false;
+    const productCode = parts.slice(1, -1).join('-');
+    const secret = `correctover-${productCode}-2026`;
+    const expected = crypto.createHash('sha256').update(secret).digest('hex').slice(0, 12);
+    return parts[parts.length - 1].startsWith(expected);
+  }
+
+  // CV-TRL-<base64> / CV-PRO-<base64> (FC XunhuPay)
+  if (key.startsWith('CV-')) {
+    const parts = key.split('-', 2);
+    if (parts.length < 3) return false;
+    try {
+      let payload = parts[2];
+      const dot = payload.indexOf('.');
+      if (dot > 0) payload = payload.substring(0, dot);
+      const decoded = Buffer.from(payload, 'base64url').toString();
+      return decoded.includes('@') || decoded.length > 10;
+    } catch (e) {
+      return false;
+    }
+  }
+
+  return false;
+}
+
+function checkLicense(product) {
+  const state = loadState();
+  const ps = getProductState(state, product);
+  const licenseKey = state.license_key || process.env.CORRECTOVER_LICENSE_KEY;
+
+  if (licenseKey && verifyLicenseKey(licenseKey)) {
+    return {
+      authorized: true,
+      tier: 'pro',
+      calls_remaining: Infinity,
+      calls_today: ps.calls_today,
+      limit: Infinity,
+    };
+  }
+
+  const remaining = Math.max(0, FREE_LIMIT_PER_DAY - ps.calls_today);
+  return {
+    authorized: remaining > 0,
+    tier: 'free',
+    calls_remaining: remaining,
+    calls_today: ps.calls_today,
+    limit: FREE_LIMIT_PER_DAY,
+  };
+}
+
+function recordCall(product) {
+  const state = loadState();
+  const status = checkLicense(product);
+  if (!status.authorized) return status;
+
+  const ps = getProductState(state, product);
+  ps.calls_today += 1;
+  ps.total_calls = (ps.total_calls || 0) + 1;
+  saveState(state);
+
+  status.calls_remaining = Math.max(0, status.limit - ps.calls_today);
+  status.calls_today = ps.calls_today;
+  return status;
+}
+
+function getUpgradeMessage(status) {
+  if (status.tier !== 'free') return '';
+  if (status.calls_remaining <= 0) {
+    return `\n🚫 Free tier limit reached (${FREE_LIMIT_PER_DAY} scans/day).\n   Upgrade: https://correctover.com/checkout\n   Or: export CORRECTOVER_LICENSE_KEY=<your-key>\n`;
+  }
+  return `\n📊 Free tier: ${status.calls_remaining} scans remaining today.\n   Upgrade: https://correctover.com/checkout\n`;
+}
+
+module.exports = {
+  FREE_LIMIT_PER_DAY,
+  checkLicense,
+  recordCall,
+  getUpgradeMessage,
+  verifyLicenseKey,
+};

package/index.js

@@ -10,8 +10,10 @@
 const fs = require('fs');
 const path = require('path');
 const { runScan, parseConfig, KNOWN_CONFIG_PATHS } = require('./core/scanner');
+const { recordCall, getUpgradeMessage } = require('./core/license');
 
-const VERSION = '1.0.0';
+const VERSION = '1.2.0';
+const PRODUCT = 'correctover-scan';
 
 // Colors
 const c = {
@@ -112,11 +114,11 @@ function formatResults(results, stats, filename) {
   if (stats.fail > 0 || stats.score < 60) {
     lines.push(`${c.yellow}${c.bold}⚡ Score too low? CCS Pro generates formal compliance reports.${c.reset}`);
     lines.push(`${c.dim}   Enterprise: real-time runtime protection + Token guarantee${c.reset}`);
-    lines.push(`${c.cyan}   → Join waitlist: https://correctover.com/waitlist/${c.reset}`);
+    lines.push(`${c.cyan}   → Upgrade: https://correctover.com/checkout${c.reset}`);
   } else {
     lines.push(`${c.green}✓ Good score! Get a formal compliance certificate with CCS Pro.${c.reset}`);
     lines.push(`${c.dim}  Audit reports · Team dashboard · Custom rules · SOC 2 ready${c.reset}`);
-    lines.push(`${c.cyan}  → https://correctover.com/waitlist/${c.reset}`);
+    lines.push(`${c.cyan}  → https://correctover.com/checkout${c.reset}`);
   }
   lines.push(`${c.dim}Enterprise: runtime SDK + Token guarantee → https://correctover.com${c.reset}`);
   lines.push('');
@@ -204,6 +206,19 @@ Examples:
 
   printBanner();
 
+  // License check
+  const status = recordCall(PRODUCT);
+  if (!status.authorized) {
+    console.log(getUpgradeMessage(status));
+    process.exit(1);
+  }
+  if (status.tier === 'free') {
+    console.log(`${c.dim}📊 Free tier: ${status.calls_remaining} scans remaining today (${status.calls_today}/${status.limit})${c.reset}`);
+    console.log(`${c.dim}   Upgrade: https://correctover.com/checkout${c.reset}\n`);
+  } else if (status.tier === 'pro') {
+    console.log(`${c.green}✅ Pro license active — unlimited scans${c.reset}\n`);
+  }
+
   const filesToScan = [];
 
   if (configPath) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "correctover-scan",
-  "version": "1.1.0",
-  "description": "CCS Security Scanner for MCP configurations — scan Agent security configs against OWASP AISVS 1.0",
+  "version": "1.2.1",
+  "description": "MCP security scanner — 1 command, 14 OWASP AISVS 1.0 checks. Detect RCE, SSRF, credential exposure in your Model Context Protocol configs. Free: 50 scans/day.",
   "main": "index.js",
   "bin": {
     "correctover-scan": "./index.js"
@@ -39,6 +39,7 @@
   "files": [
     "index.js",
     "core/scanner.js",
+    "core/license.js",
     "README.md"
   ],
   "engines": {