guardvibe 2.9.0 → 2.9.1

package/README.md

@@ -177,8 +177,8 @@ Dockerfile security, GitHub Actions CI/CD, Terraform (S3, IAM, RDS, security gro
 ### Secrets & Environment
 API keys (AWS, GitHub, Stripe, OpenAI, Resend, Turso), .env management, .gitignore coverage, high-entropy detection, NEXT_PUBLIC exposure
 
-### Compliance
-SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act (EUAIACT) control mapping with compliance reports
+### Compliance Control Mapping
+Maps security findings to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, and EU AI Act (EUAIACT) controls. Identifies which code-level vulnerabilities are relevant to specific compliance requirements. **Not a substitute for professional compliance audits.**
 
 ### Supply Chain
 Malicious postinstall scripts, unpinned GitHub Actions, typosquat detection
@@ -195,7 +195,7 @@ Malicious postinstall scripts, unpinned GitHub Actions, typosquat detection
 | `scan_secrets` | Detect leaked secrets, API keys, tokens |
 | `check_dependencies` | Check individual packages against OSV |
 | `check_package_health` | Typosquat detection, maintenance status, adoption metrics |
-| `compliance_report` | SOC2 / PCI-DSS / HIPAA / GDPR / ISO27001 / EU AI Act compliance mapping |
+| `compliance_report` | Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act) |
 | `export_sarif` | SARIF v2.1.0 export for CI/CD integration |
 | `get_security_docs` | Security best practices and guides |
 | `fix_code` | **Auto-fix suggestions** with concrete patches for AI agents |

package/build/index.js

@@ -43,7 +43,7 @@ import { fixCode as fixCodeTool } from "./tools/fix-code.js";
 const server = new McpServer({
     name: "guardvibe",
     version: pkg.version,
-    description: "Security MCP for vibe coding. 334 security rules and 31 tools covering OWASP, Next.js, Supabase, Stripe, Clerk, Prisma, Hono, AI SDK, MCP server security, and host environment hardening. Scans code, dependencies, secrets, configs, and git history. Generates compliance reports (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act). Runs 100% locally with zero configuration.",
+    description: "Security MCP for vibe coding. 334 security rules and 31 tools covering OWASP, Next.js, Supabase, Stripe, Clerk, Prisma, Hono, AI SDK, MCP server security, and host environment hardening. Scans code, dependencies, secrets, configs, and git history. Maps security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act). Runs 100% locally with zero configuration. Note: GuardVibe is a security scanner, not a compliance auditor — it helps identify code-level issues relevant to compliance frameworks but does not replace professional compliance audits.",
 });
 // Tool 1: Analyze code for security vulnerabilities
 server.tool("check_code", "Analyze code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Use this when reviewing or writing code to catch security issues early.", {
@@ -235,7 +235,7 @@ server.tool("scan_staged", "Scan git-staged files for security vulnerabilities b
     return { content: [{ type: "text", text: results + summary }] };
 });
 // Tool 9: Generate compliance-focused security report
-server.tool("compliance_report", "Generate a compliance-focused security report mapped to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, or EUAIACT (EU AI Act) controls. Scans a directory and groups findings by compliance control. Includes exploit scenarios and audit evidence for each finding. Use mode=executive for a C-level summary.", {
+server.tool("compliance_report", "Map security scan findings to compliance framework controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EUAIACT). Scans a directory and groups code-level security issues by the compliance control they relate to. Includes exploit scenarios and remediation evidence for each finding. Use mode=executive for a risk summary. Note: this maps code vulnerabilities to controls — it does not perform a compliance audit or replace professional assessment.", {
     path: z.string().describe("Directory to scan"),
     framework: z.enum(["SOC2", "PCI-DSS", "HIPAA", "GDPR", "ISO27001", "EUAIACT", "all"]).describe("Compliance framework"),
     format: z.enum(["markdown", "json"]).default("markdown").describe("Output format: markdown (human) or json (machine-readable for agents)"),
@@ -590,7 +590,7 @@ server.tool("security_workflow", "Get the recommended GuardVibe security workflo
         "pr_review",
         "new_project",
         "fix_vulnerabilities",
-        "compliance_audit",
+        "compliance_mapping",
         "dependency_check",
     ]).describe("What you are currently doing"),
 }, async ({ task }) => {
@@ -642,11 +642,11 @@ server.tool("security_workflow", "Get the recommended GuardVibe security workflo
             ],
         },
         compliance_audit: {
-            task: "compliance_audit",
-            description: "Generate compliance reports for regulatory frameworks.",
+            task: "compliance_mapping",
+            description: "Map security findings to compliance framework controls. This identifies code-level issues relevant to specific controls — it does not replace professional compliance audits.",
             steps: [
-                { tool: "compliance_report", params: { path: ".", framework: "<SOC2|PCI-DSS|HIPAA|GDPR|ISO27001|EUAIACT>", format: "json" }, purpose: "Generate compliance-mapped findings report." },
-                { tool: "explain_remediation", params: { ruleId: "<id>" }, purpose: "Get audit evidence and fix strategies for each finding.", condition: "for each finding" },
+                { tool: "compliance_report", params: { path: ".", framework: "<SOC2|PCI-DSS|HIPAA|GDPR|ISO27001|EUAIACT>", format: "json" }, purpose: "Scan code and map findings to compliance controls." },
+                { tool: "explain_remediation", params: { ruleId: "<id>" }, purpose: "Get remediation guidance and fix strategies for each finding.", condition: "for each finding" },
             ],
         },
         dependency_check: {

package/build/tools/compliance-report.js

@@ -77,16 +77,18 @@ export function complianceReport(path, framework, format = "markdown", rules, mo
     }
     // --- FULL MODE ---
     const lines = [
-        `# GuardVibe Compliance Report`,
+        `# GuardVibe Compliance Control Mapping`,
+        ``,
+        `> This report maps code-level security findings to ${framework} controls. It identifies vulnerabilities relevant to compliance requirements but is not a substitute for professional compliance audits.`,
         ``,
         `Framework: ${framework}`,
         `Directory: ${scanRoot}`,
         `Files scanned: ${filePaths.length}`,
-        `Compliance issues: ${relevant.length}`,
+        `Security issues mapped to controls: ${relevant.length}`,
         ``,
     ];
     if (controlMap.size === 0) {
-        lines.push(`## No Compliance Issues`, ``, `No issues mapped to ${framework} controls were found.`);
+        lines.push(`## No Issues Found`, ``, `No code-level security issues mapped to ${framework} controls were found. This does not constitute a compliance certification.`);
         return lines.join("\n");
     }
     // Sort controls
@@ -120,7 +122,9 @@ function formatExecutiveSummary(framework, scanRoot, filesScanned, relevant, con
     const total = critical + high + medium;
     const riskLevel = critical > 0 ? "HIGH" : high > 0 ? "MEDIUM" : total > 0 ? "LOW" : "MINIMAL";
     const lines = [
-        `# Executive Security Summary`,
+        `# Security Findings — ${framework} Control Mapping`,
+        ``,
+        `> Maps code-level security findings to ${framework} controls. Not a compliance audit or certification.`,
         ``,
         `**Framework:** ${framework} | **Date:** ${new Date().toISOString().split("T")[0]}`,
         `**Directory:** ${scanRoot}`,
@@ -167,7 +171,7 @@ function formatExecutiveSummary(framework, scanRoot, filesScanned, relevant, con
         }
     }
     // Compliance coverage
-    lines.push(`## Compliance Coverage`, ``, `| Control | Status | Issues |`, `|---------|--------|--------|`);
+    lines.push(`## Controls with Findings`, ``, `| Control | Status | Issues |`, `|---------|--------|--------|`);
     const sortedControls = [...controlMap.entries()].sort((a, b) => a[0].localeCompare(b[0]));
     for (const [control, items] of sortedControls) {
         const hasCritical = items.some(i => i.finding.rule.severity === "critical");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "2.9.0",
+  "version": "2.9.1",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 31 tools, CLI + doctor. Host security: CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit, AI host hardening. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",