correctover-scan 3.2.2 → 3.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -9
- package/core/skillpay.js +12 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -20,15 +20,6 @@ the license change is not retroactive.
|
|
|
20
20
|
|
|
21
21
|
---
|
|
22
22
|
|
|
23
|
-
### 🇨🇳 国内用户 · 支付宝一键购买
|
|
24
|
-
|
|
25
|
-
本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：
|
|
26
|
-
|
|
27
|
-
- 打开货架：https://skillpay.alipay.com/public/correctover
|
|
28
|
-
- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**
|
|
29
|
-
|
|
30
|
-
---
|
|
31
|
-
|
|
32
23
|
|
|
33
24
|
 [](https://datatracker.ietf.org/doc/draft-correctover-ccs/)
|
|
34
25
|
|
|
@@ -55,6 +46,18 @@ npx correctover-scan@latest
|
|
|
55
46
|
|
|
56
47
|
It auto-detects MCP config files (`.cursor/mcp.json`, `claude_desktop_config.json`, `.claude/mcp.json`, `mcp.json`, `.vscode/mcp.json` and more) and runs 14 checks. Everything runs locally on your machine — config files are not uploaded.
|
|
57
48
|
|
|
49
|
+
### 🇨🇳 免费扫描之外 · 支付宝 SkillPay
|
|
50
|
+
|
|
51
|
+
免费的自动扫描覆盖配置层面的风险检查。如果你需要人工深度审计或正式合规凭证，可以在支付宝 SkillPay 货架获取：
|
|
52
|
+
|
|
53
|
+
- 货架首页：https://skillpay.alipay.com/public/correctover
|
|
54
|
+
- 也可以在支持「支付宝 AI 付」的智能体对话里直接输入对应服务名唤起购买：
|
|
55
|
+
- **MCP配置安全体检**：`请通过 SkillPay 购买并安装 Skill「MCP配置安全体检」`
|
|
56
|
+
- **CCS收据批量审计**：`请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」`
|
|
57
|
+
- **CCS收据验签**：`请通过 SkillPay 购买并安装 Skill「CCS收据验签」`
|
|
58
|
+
|
|
59
|
+
*Beyond the free scan: human-led deep audits and compliance evidence are available on the Alipay SkillPay shelf — open the link above, or type the service name (e.g. **MCP配置安全体检**) in an agent with Alipay AI Pay enabled.*
|
|
60
|
+
|
|
58
61
|
```bash
|
|
59
62
|
# Scan a specific config file
|
|
60
63
|
npx correctover-scan mcp.json
|
package/core/skillpay.js
CHANGED
|
@@ -15,9 +15,18 @@ const STORE_URL = 'https://skillpay.alipay.com/public/correctover';
|
|
|
15
15
|
// Fill a direct product link here the moment Alipay exposes one; when present
|
|
16
16
|
// it is shown in preference to the generic shelf URL.
|
|
17
17
|
const PRODUCTS = {
|
|
18
|
-
scan: {
|
|
19
|
-
|
|
20
|
-
|
|
18
|
+
scan: {
|
|
19
|
+
name: 'MCP配置安全体检',
|
|
20
|
+
url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205849036&merchantCode=correctover',
|
|
21
|
+
},
|
|
22
|
+
verify: {
|
|
23
|
+
name: 'CCS收据验签',
|
|
24
|
+
url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205845606&merchantCode=correctover',
|
|
25
|
+
},
|
|
26
|
+
audit: {
|
|
27
|
+
name: 'CCS收据批量审计',
|
|
28
|
+
url: 'https://skillpay.alipay.com/public/correctover/shelf/product?productId=P0806000205847426&merchantCode=correctover',
|
|
29
|
+
},
|
|
21
30
|
};
|
|
22
31
|
|
|
23
32
|
// Shelf prices (CNY). Owner-supplied 2026-09-27; keep identical to the shelf.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "correctover-scan",
|
|
3
|
-
"version": "3.2.
|
|
3
|
+
"version": "3.2.3",
|
|
4
4
|
"description": "Correctover Security Scanner — CCS audit for MCP configurations AND published JS bundles/npm packages. Detects hardcoded secrets, RCE, SSRF, credential hijacking against OWASP AISVS 1.0.",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"bin": {
|