praxis-sec 1.2.1 → 1.2.4

package/configs/firebase/security-checklist.md

@@ -24,11 +24,11 @@ allow read, write: if request.time < timestamp.date(2024, 12, 31);
 ### 2. [ ] Firestore rules require authentication
 
 ```javascript
-// GOOD: Requires authentication
+// Authentication check alone: insufficient for private per-user data
 allow read, write: if request.auth != null;
 
 // BETTER: Requires authentication AND ownership
-allow read, write: if request.auth.uid == userId;
+allow read, write: if request.auth != null && request.auth.uid == userId;
 ```
 
 ### 3. [ ] Storage rules have file type validation
@@ -49,7 +49,7 @@ allow write: if request.resource.size < 5 * 1024 * 1024;
 ### 5. [ ] Default deny rule at the end
 
 ```javascript
-// Catch-all: deny everything not explicitly allowed
+// Explicit default deny. Matching allow rules are additive; this does not override another allow.
 match /{document=**} {
   allow read, write: if false;
 }

package/configs/supabase/security-checklist.md

@@ -2,42 +2,40 @@
 
 **Complete this checklist before launching your Supabase-powered app.**
 
-Based on [CVE-2025-48757](https://byteiota.com/supabase-security-flaw-170-apps-exposed-by-missing-rls/) and common pentesting findings.
+Follow [Supabase RLS guidance](https://supabase.com/docs/guides/database/postgres/row-level-security). Test allow and deny behavior for each operation and role; these examples are not proof of access isolation.
 
 ---
 
 ## Critical: Row Level Security (RLS)
 
-### 1. [ ] RLS is ENABLED on ALL tables
+### 1. [ ] RLS is enabled on tables exposed to application users
 
 ```sql
 -- Check which tables DON'T have RLS
-SELECT schemaname, tablename
-FROM pg_tables
-WHERE schemaname = 'public'
-AND tablename NOT IN (
-  SELECT tablename::text FROM pg_class
-  WHERE relrowsecurity = true
-);
+SELECT n.nspname AS schemaname, c.relname AS tablename
+FROM pg_class AS c
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE n.nspname = 'public'
+  AND c.relkind IN ('r', 'p')
+  AND NOT c.relrowsecurity;
 ```
 
-**If any tables appear, enable RLS immediately:**
+**Review exposed tables and enable RLS with tested policies and grants:**
 ```sql
 ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;
 ```
 
-### 2. [ ] Every table has at least one policy
+### 2. [ ] Exposed tables have the policies needed for intended operations
 
 ```sql
--- Tables with RLS enabled but NO policies (locked to everyone!)
-SELECT tablename FROM pg_tables
-WHERE schemaname = 'public'
-AND tablename IN (
-  SELECT tablename::text FROM pg_class WHERE relrowsecurity = true
-)
-AND tablename NOT IN (
-  SELECT tablename FROM pg_policies
-);
+-- RLS tables with no policies: ordinary roles are denied, but bypass roles differ.
+SELECT n.nspname AS schemaname, c.relname AS tablename
+FROM pg_class AS c
+JOIN pg_namespace AS n ON n.oid = c.relnamespace
+WHERE n.nspname = 'public'
+  AND c.relkind IN ('r', 'p')
+  AND c.relrowsecurity
+  AND NOT EXISTS (SELECT 1 FROM pg_policy AS p WHERE p.polrelid = c.oid);
 ```
 
 ### 3. [ ] Policies use `auth.uid()` not hardcoded values
@@ -97,7 +95,7 @@ grep -r "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" ./src
 The `anon` key is designed to be public, but only if RLS is properly configured.
 
 ```typescript
-// Frontend: Use anon key (safe if RLS is set up)
+// Frontend: use the appropriate public key with tested RLS policies and grants
 const supabase = createClient(url, anonKey);
 
 // Server: Use service_role key (for admin operations)

package/docs/RELEASE-1.2.4.md

@@ -0,0 +1,85 @@
+# Praxis 1.2.4
+
+This patch corrects cases where a scan could report success without examining the
+requested target, and fixes project targeting in the older annotation loop.
+
+- Full, secret, and CI scans require a directory. A file supplied as a scan root
+  now produces an error instead of a false empty result. The VS Code current-file
+  action scans its workspace and selects diagnostics for the requested file.
+- Full-scan JSON includes `scanComplete`, `scanErrors`, and `dependencyAudit`.
+  Failed discovery, failed agents, unavailable dependency audits, or failed
+  requested legal scans mark the result incomplete and exit unsuccessfully.
+  Findings alone still do not fail a normal scan; use `scan ci` for severity gates.
+- Incomplete scans do not update scan cache, score history, or the playbook, and
+  cannot start the annotation loop or satisfy fix verification. HTML reports show
+  an incomplete warning; the web runner refuses failed-agent results.
+  A failed annotation-loop verification also overrides `--fail-below`; JSON
+  reports the failure once without inner-scan progress text. Reports are generated
+  after verification so HTML and machine-readable status agree.
+- `scan full --timeout` now reaches the orchestrator.
+- Annotation targets resolve inside the requested project, including symlink
+  destinations. Protected scanner/Git paths and unsupported comment formats such
+  as JSON are rejected. Writes are atomic, and unchanged annotations are not
+  counted as applied. Multiple annotations in one file are inserted from the
+  bottom to preserve finding line numbers; replaying the same report is safe.
+- In-root directories beginning with two dots retain their full relative path.
+  Foreign Windows backslash and UNC paths fall back to a safe basename.
+- Memory-poisoning document discovery respects ignore rules and dependency
+  directories instead of reading ignored nested artifacts as project context.
+- File discovery uses `tinyglobby` in place of the vulnerable
+  `fast-glob → micromatch → braces` chain. Directory expansion stays disabled,
+  brace limits and symlink boundaries remain enforced, and discovery has tests
+  for hidden files, exclusions, extglobs, literal directories, and async/sync parity.
+- Exact provider-documented non-working credentials are recognized from an
+  attributed data catalog. Unknown credentials on the same line still produce
+  findings. History scans process all matches, distinguish credentials that share
+  the same masked display, and report operational failures as incomplete.
+- Upload rules require request/upload filename evidence instead of treating
+  local package metadata or any variable named `filename` as a vulnerable upload.
+- The independently versioned VS Code extension is prepared as 1.0.1. CLI calls
+  use executable/argument arrays instead of shell text, and default npx execution
+  forbids automatic package installation. Report fields are escaped, severity
+  classes are sanitized, and a Content-Security-Policy blocks remote content.
+  Windows npm launchers resolve to the CLI's JavaScript entry point, preserving
+  literal arguments without invoking a command shell.
+
+- MCP suppression now writes on the matched line, preserves line endings, rejects
+  unsupported formats and non-integer lines, and writes atomically. MCP repository
+  scans use the current scoring API, expose agent failures as incomplete, and
+  reject file roots.
+- Hermes handlers return structured audit/manifest results, read the explicit saved
+  report path, apply severity filtering, and register against corrected integrity
+  hashes. Default Hermes audits disclose skipped dependency checks.
+- Documentation uses canonical commands, preserves errors, corrects CI examples,
+  describes data egress and score limitations, and provides a release procedure.
+  The Claude Code plugin instructions are independently versioned as 3.0.1.
+
+## Validation and limitations
+
+Release validation covers the CLI test suite on Node 18, 20, 22 and 24, lint,
+extension compilation and runtime tests, scan determinism, a complete zero-critical
+self-scan, local PR Action base/head comparison, and installed-package smoke tests.
+The production dependency chain was removed rather than overridden; the reviewed
+full dependency audit, including development dependencies, reports zero advisories.
+Audit results reflect the advisory database at the time of verification.
+
+AWS explicitly identifies the formerly reported fixture credential as
+[non-working example data](https://docs.aws.amazon.com/AmazonS3/latest/developerguide/RESTAuthentication.html).
+Only that exact identifier in AWS credential rules is exempted; tests retain
+unknown credentials on the same line. History and test files are not excluded.
+
+Noncritical heuristic findings and existing lint warnings remain. A self-scan
+score is not a measurement of scanner accuracy. Live LLM provider behavior and
+interactive VS Code UI behavior were not validated by these release checks.
+
+## Distribution
+
+The GitHub release, immutable `v1.2.4` tag, and floating Marketplace Action `v1`
+are prepared from the same commit after its hosted CI succeeds. The release
+includes the npm package tarball and a SHA-256 checksum. **npm publication is a
+separate maintainer step**; a GitHub release does not change npm latest.
+
+Use `Ganron007/Praxis@v1.2.4` to pin the Action. For CLI use before npm publication,
+install the attached tarball or run from a checkout of this tag. After publication,
+install `praxis-sec@1.2.4` from npm. See [the release procedure](RELEASING.md) for
+the checks and publishing handoff.

package/docs/RELEASING.md

@@ -0,0 +1,51 @@
+# Releasing Praxis
+
+The CLI/npm package, GitHub Action, Claude Code plugin, and VS Code extension
+have separate distribution surfaces. A GitHub release does not publish npm or
+the VS Code extension.
+
+## Prepare
+
+1. Choose the CLI patch version and update `package.json`, both root lockfile
+   version fields, and `docs/RELEASE-<version>.md`.
+2. Update public examples to the intended Action tag. Keep independently
+   versioned integrations consistent with their own manifests and lockfiles.
+3. Run `npm ci` and `npm run release:check`. This checks CLI tests, lint,
+   production dependency advisories, scan determinism, a complete zero-critical
+   self-scan, editor compilation/runtime tests, package exclusions, and an
+   installed-package scan with redaction and cache parity.
+4. Review `git diff --check` and the package contents. Keep `docs/internal/`,
+   runtime state, credentials, test fixtures, and local binaries out of Git and
+   the npm package.
+
+## GitHub and Marketplace
+
+1. Commit the complete release and push it. Wait for CI to pass on that exact
+   commit, including all four Node versions, determinism, package/editor checks,
+   and the local Action smoke test.
+2. Create an annotated immutable version tag, such as `v1.2.4`, on that commit.
+   Never replace a previously published version tag with different source.
+3. Pack the committed source with `npm pack`. Attach the tarball and its SHA-256
+   checksum to the GitHub release, using the reviewed release notes.
+4. Advance the floating `v1` Action tag deliberately to the same commit. Check
+   the prior remote value first and protect the update against concurrent changes.
+5. Verify the release, version tag, floating tag, assets, and successful CI all
+   refer to the reviewed source. Consumers can use the exact version tag or
+   commit instead of the floating tag.
+
+## npm publication
+
+The maintainer publishes npm separately from the same clean, committed checkout:
+
+```bash
+git checkout v1.2.4
+npm ci
+npm publish
+```
+
+`prepublishOnly` reruns the release gates and rejects an uncommitted working
+tree or a version different from the committed package metadata. Authentication
+and npm account requirements must be satisfied by the publishing maintainer.
+After publication, confirm `npm view praxis-sec version dist-tags` and install
+that exact registry version in a clean project. GitHub and npm may legitimately
+show different versions until this step completes.

package/docs/THIRD_PARTY_NOTICES.md

@@ -17,6 +17,14 @@ and attribution as required.
 - **Source:** https://github.com/0x4D31/endpoint-ai-agent-abuse (v0.1.0)
 - **License:** CC0-1.0 (public domain dedication) — https://creativecommons.org/publicdomain/zero/1.0/
 
+## Documented non-working credential examples
+
+- **File:** `cli/data/documented-secret-examples.json`
+- **Source:** [AWS S3 authentication examples](https://docs.aws.amazon.com/AmazonS3/latest/developerguide/RESTAuthentication.html)
+- Contains one exact identifier AWS labels non-working, with our own annotations.
+  No documentation prose is reproduced. This is factual example provenance, not
+  permission to suppress arbitrary credentials, test files, or repository history.
+
 ## Standards referenced (not vendored)
 
 Findings are mapped to the following frameworks; their text is not reproduced:

package/docs/THREAT_INTEL.md

@@ -12,7 +12,9 @@ For everything else (general CLI usage, scanning, hooks, etc.), see the main
 
 ## 1. Commands
 
-Run these from any directory — they only touch `~/.praxis/` (your home dir).
+Feed-update commands store caches under `~/.praxis/`. Scan commands also read
+the selected project and can update its local Praxis state. Updates contact
+configured remote sources; cached data is not a guarantee of current coverage.
 
 | Command | What it does |
 | --- | --- |
@@ -35,7 +37,7 @@ over no data.
 praxis intel update
 ```
 
-Expected output:
+Illustrative output (versions and counts depend on the fetched feeds):
 
 ```
   Fetching sources...

package/docs/USAGE.md

@@ -1,10 +1,14 @@
 # Praxis — Complete Usage Guide
 
-AI-native security CLI for AI-augmented codebases. Single binary, find→fix→verify
-loop on autopilot. 28 parallel security agents (24 built-in + ModelFileScanner +
-PromptInjectionProber + AgentTelemetryAgent + EndpointAgentAbuseAgent), multi-source threat intel, modular alignment with 8 AI-security
-standards, LLM-powered remediation with diff review and undo log. Works fully
-offline; LLM features are optional.
+Security CLI for AI applications and codebases. Praxis runs 28 built-in scanners
+in parallel batches, maps findings to security standards, and supports reviewed
+LLM remediations with verification and an undo log. Requires Node.js 18 or newer.
+
+For a local static audit, use `praxis scan . --no-ai --no-deps`. Default dependency
+audits contact package services, and configured LLM providers may classify findings.
+`--deep`, swarm analysis, LLM fixes, credential verification, feed updates, Git
+clones, and live probes can also contact external services. `--no-ai` disables
+classification; it does not disable those separately requested features.
 
 ---
 
@@ -42,7 +46,7 @@ offline; LLM features are optional.
 
 ```bash
 # From source (this repo)
-npm install
+npm ci
 npm link                         # exposes `praxis` globally
 
 # Or run directly without linking
@@ -93,6 +97,22 @@ Plus three top-level shortcuts: `praxis vibe`, `praxis score`, and `praxis` alon
 
 Full audit: secrets + 28 agents + deps + score + remediation plan.
 
+Local scan roots must be existing directories. Passing a file produces an error.
+Use `scan changed` for a change-based scan; the editor's current-file command
+scans its workspace and selects findings for that file.
+
+Full-scan JSON contains:
+
+- `scanComplete`: true only when required scan stages completed.
+- `scanErrors`: errors from discovery, agents, dependency auditing, or requested legal analysis.
+- `dependencyAudit`: `complete`, `skipped`, `not-applicable`, or `failed`.
+
+Incomplete scans exit 1, do not refresh scan cache/history/playbook state, and
+cannot verify a fix. Findings alone do not fail a normal full scan; use `scan ci`
+for severity or score gates. Keep stderr and inspect completion before treating
+JSON output or a high score as a successful assessment. Skipped checks provide
+no assurance for that part of the project.
+
 | Flag | Description |
 | --- | --- |
 | `--json` | Output results as JSON |
@@ -116,7 +136,7 @@ Full audit: secrets + 28 agents + deps + score + remediation plan.
 | `--budget <cents>` | Max spend in cents for deep analysis (default 50) |
 | `--verify` | Check if leaked secrets are still active |
 | `--include-legal` | Also run the legal risk scan |
-| `--agentic [iterations]` | Agentic scan→fix→verify loop |
+| `--agentic [iterations]` | Legacy annotation loop: adds review comments, then re-scans; does not apply the proposed remediation |
 | `--agentic-target <score>` | Target security score for agentic loop |
 | `--hermes-only` | Run only Hermes-relevant agents |
 | `--fail-below <threshold>` | Exit 1 if score < threshold |
@@ -182,13 +202,13 @@ Credential health check: `.env` coverage, source cross-ref, git history.
 
 ### `scan redteam [path]` / `praxis redteam [target]`
 
-Dynamic AI Red Teaming & DAST Prober: executes 80+ attack classes statically and probes live LLM endpoints / agent runtimes with jailbreak, prompt injection, and goal-hijacking payloads.
+`scan redteam <directory>` runs the static adversarial agent pack.
+`praxis redteam <endpoint>` runs dynamic probes against an authorized live LLM
+endpoint. These commands have different options; consult each command's `--help`.
+The table below describes the static command.
 
 | Flag | Description |
 | --- | --- |
-| `--endpoint <url>` | Target live LLM API endpoint for dynamic DAST probing |
-| `--model <model>` | Target model identifier |
-| `--probes <tags>` | Comma-separated probe categories (`jailbreak`, `injection`, `override`, `exfil`) |
 | `--agents <list>` | Comma-separated list of static agents to run |
 | `--json` | JSON output |
 | `--sarif` | SARIF output |
@@ -197,13 +217,13 @@ Dynamic AI Red Teaming & DAST Prober: executes 80+ attack classes statically and
 | `--no-deps` | Skip dependency audit |
 | `--no-ai` | Skip AI classification |
 | `--deep` | LLM-powered taint analysis with AST scope evaluation |
-| `--swarm` | AI swarm mode — 23 parallel agents via DeepSeek/Kimi |
+| `--swarm` | Send selected source context and role instructions to a configured swarm provider; provider execution is separate from the 28 local scanners |
 | `--think`, `--local`, `--model`, `--provider`, `--base-url`, `--budget` | LLM controls (same as `scan full`) |
 | `-v, --verbose` | Verbose output |
 
 ### `scan standard [name] [path]`
 
-Filter findings by AI-security standard. **New in this release.**
+Filter findings by AI-security standard.
 
 | Flag | Description |
 | --- | --- |
@@ -583,7 +603,7 @@ than silently passed off as checked.
 Rule **ids are identifiers** (`AWS_ACCESS_KEY_ID`, not `AWS Access Key ID`), because
 Semgrep suppressions (`# nosemgrep:`) and baselining key on them.
 
-**Scope — what the export does not cover.** 411 of the rules are static patterns. Three
+**Scope — what the export does not cover.** The inventory identifies the rules that are static patterns. Three
 layers have no Semgrep representation and are declared in the manifest rather than
 approximated:
 
@@ -803,7 +823,7 @@ Praxis incorporates a pure ESM, zero-native-dependency AST & CST analysis engine
 | --- | --- |
 | `ANTHROPIC_API_KEY` | Claude (Opus / Sonnet / Haiku) |
 | `OPENAI_API_KEY` | OpenAI (GPT-4 / GPT-4o / o1) |
-| `GOOGLE_AI_API_KEY` | Gemini |
+| `GOOGLE_API_KEY` / `GEMINI_API_KEY` | Gemini |
 | `MOONSHOT_API_KEY` | Kimi |
 | `OPENAI_BASE_URL` | Custom OpenAI-compatible endpoint (OpenRouter, Groq, DeepSeek, LM Studio, vLLM, ...) |
 | `PRAXIS_LLM_MODEL` | Default model when no `--model` flag is given |
@@ -961,7 +981,7 @@ only ever emits a known class name.
 prints a provenance line in its footer:
 
 ```
-praxis 1.2.1 · node v24.14.1 · probes v1.1(23) · threatpack v1.1(3) · eaa v0.1.0 · files 214
+praxis <version> · node <runtime> · probes <version/count> · threatpack <version/count> · eaa <version> · files <count>
 ```
 
 It records the tool version, the runtime, and the version of every vendored data asset
@@ -999,66 +1019,66 @@ between releases.
 
 ## CI/CD integration
 
-### GitHub Action (composite)
+### GitHub Action
 
-The repo ships an `action.yml` (composite action) that runs `praxis ci` and
-uploads SARIF.
+The [Marketplace Action](https://github.com/marketplace/actions/praxis-security-scan)
+installs dependencies from its own lockfile and scans with the code selected by
+the Action ref. It does not depend on npm latest being synchronized with GitHub.
 
 ```yaml
-- uses: ./
-  with:
-    path: .
-    threshold: '80'
-    deep: 'false'
-    deps: 'true'
-    sarif: 'true'
-    comment: 'true'
-    # PR regression gating — scan the base ref and fail only on NEW findings
-    net-new: 'true'
-    fail-on-new: 'high'
-    # severity floor a baseline can't suppress
-    always-fail-on: 'critical'
-  env:
-    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+name: Security
+on: [push, pull_request]
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+jobs:
+  praxis:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: Ganron007/Praxis@v1.2.4
+        with:
+          path: '.'
+          threshold: '80'
+          deps: 'true'
+          deep: 'false'
+          sarif: 'true'
+          comment: 'true'
+          net-new: 'true'
+          fail-on-new: 'high'
+          always-fail-on: 'critical'
 ```
 
-Outputs: `score`, `grade`, `findings`, `secrets`, `vulns`, `cves`, `sarif-file`.
+Use a release tag or commit for reproducibility; `v1` is a floating release-line
+tag. Inside this repository, `uses: ./` runs the checked-out source.
 
-**Net-new PR gating** (`net-new: true`, pull-request events only): the action
-checks out the PR base into a worktree, scans it, and diffs finding identities
-(`file:rule`) against the head scan. Only findings *introduced by the PR* can
-fail the build, at or above `fail-on-new`. Pre-existing debt never blocks.
+Outputs: `score`, `grade`, `findings`, `secrets`, `vulns`, `cves`,
+`sarif-file`, and `report-url`. See [action.yml](../action.yml) for all inputs.
 
-### Plain GitHub Actions
+On pull requests, `net-new: true` scans the base in a worktree and compares
+finding identities against the head scan. Introduced findings at or above
+`fail-on-new` fail the gate. `always-fail-on` also checks existing findings;
+scan and comparison failures fail the job. Other events use the normal gate.
 
-```yaml
-permissions:
-  security-events: write     # required for SARIF upload
-steps:
-  - run: npm install -g praxis-sec@latest
-  - run: praxis ci . --threshold 80 --sarif results.sarif --strict-intel
-  - uses: github/codeql-action/upload-sarif@v4
-    with: { sarif_file: results.sarif }
-```
+SARIF upload needs `security-events: write`; PR comments need
+`pull-requests: write`. Fork PR tokens and repository Code Scanning settings can
+restrict these integrations. Set `sarif: 'false'` or `comment: 'false'` when
+unavailable. The security gate operates independently of those integrations.
 
-`security-events: write` is required — without it the upload fails with a 403 even though
-the scan itself succeeded.
+### Plain CLI in CI
 
-### Using the action from another repository
+After 1.2.4 is published to npm, install that exact version in your CI setup:
 
-Once the action is listed on the GitHub Marketplace and a `v1` release tag exists:
-
-```yaml
-permissions:
-  security-events: write
-steps:
-  - uses: Ganron007/Praxis@v1
-    with:
-      net-new: 'true'
-      fail-on-new: 'high'
+```bash
+npm install -g praxis-sec@1.2.4
+praxis scan ci . --fail-on high --sarif results.sarif
 ```
 
-Inside this repository `- uses: ./` works immediately and needs no publishing step.
+Keep the command's exit status. Store JSON as a regular artifact; Praxis JSON
+is not the GitLab SAST report schema. Upload SARIF to a compatible service with
+the necessary permissions. If using `--strict-intel`, refresh the feed first
+and ensure its configured sources completed successfully.
 
 ### Determinism gate
 
@@ -1070,10 +1090,10 @@ detection change cannot land unnoticed:
 node scripts/check-determinism.mjs .
 ```
 
-CI runs this as its own job. A failure means the rule set, the probe corpus or the
-threatpack changed behaviour — which is sometimes intended (a version bump should change
-results), so the gate exists to make the change *deliberate* and visible in the diff
-rather than silent.
+CI runs this as its own job. A failure means identical inputs produced different
+finding identities across runs. Investigate unstable discovery, ordering, caches,
+or external state. An intentional detection change between releases does not
+justify drift between two scans of the same checkout.
 
 ---
 
@@ -1168,7 +1188,7 @@ plugin-side wiring required.
 | `rules import` says "YAML is an export format" | Import the sibling `praxis-rules.json`. Praxis has no YAML runtime dependency, so YAML is export-only. |
 | `praxis web` refuses to start on a non-loopback host | Remote bind requires **both** `--allow-remote` and `--token` of at least 16 characters. This is deliberate. |
 | `praxis web` won't load a project path | Projects are registered by the operator and addressed by **id**. The API intentionally does not accept client-supplied paths. |
-| Determinism gate fails in CI | Two scans of identical inputs disagreed on `file::rule`. Usually a probe-corpus or threatpack change — check `git diff` on `cli/data/`. Expected when you intentionally change detection. |
+| Determinism gate fails in CI | Two scans of identical inputs disagreed on `file::rule`. Investigate unstable discovery, caches, ordering, or external state; a detection change between commits does not justify drift in one checkout. |
 
 ---
 
@@ -1187,14 +1207,14 @@ npx praxis-sec mcp
 
 ### IDE integration
 
-Cursor / Continue config (`.continue/config.yaml` or Cursor MCP settings):
+Illustrative stdio configuration (adapt the wrapper schema to your IDE; the package must be preinstalled):
 
 ```yaml
 mcpServers:
   - name: praxis
     transport: stdio
     command: npx
-    args: ["praxis", "mcp"]
+    args: ["--no-install", "praxis-sec", "mcp"]
 ```
 
 In Docker (a container running praxis):
@@ -1204,7 +1224,7 @@ mcpServers:
   - name: praxis
     transport: stdio
     command: docker
-    args: ["exec", "-i", "darkai-ops", "praxis", "mcp"]
+    args: ["exec", "-i", "your-container", "praxis", "mcp"]
 ```
 
 ### Available MCP tools
@@ -1212,17 +1232,18 @@ mcpServers:
 | Tool | Input | Returns | Description |
 |------|-------|---------|-------------|
 | `scan_secrets` | `{ path }` | findings[] | Scan a file/directory for hardcoded secrets |
-| `scan_repo` | `{ path, deep? }` | findings[] + score | Full orchestrator scan (all 28 agents + intel) |
-| `analyze_file` | `{ path }` | findings[] | Deep LLM analysis of a single file |
-| `get_findings` | `{ severity? }` | findings[] | Retrieve cached findings (optionally filtered) |
+| `scan_repo` | `{ path, agents?, llm?, outputFile? }` | findings + score + completion | Built-in orchestrator scan; dependency audit skipped; optional LLM analysis |
+| `analyze_file` | `{ path }` | findings | Static secret analysis of a file |
+| `get_findings` | `{ reportPath, severity? }` | report + findings | Read an explicitly saved JSON report |
 | `get_checklist` | — | checklist[] | Launch-day security checklist items |
-| `suppress_finding` | `{ id, reason }` | `{ ok }` | Suppress a finding (writes to `.praxis/ignores.json`) |
+| `suppress_finding` | `{ file, line, reason }` | suppression status | Append a trailing comment to a reviewed source line; supported comment formats only |
+| `explain_and_fix` | `{ file, line, rule }` | explanation + preview | AST-aware explanation and proposed fix preview |
 
 ### Example MCP interaction
 
 When connected, an IDE user can ask: *"Scan this file for AI vulnerabilities"*
 and the LLM calls `scan_repo` — Praxis findings appear inline in the chat with
-file:line references. The `deep` flag triggers LLM-powered taint analysis.
+file:line references. The `llm` option requests provider-backed analysis. Require `scanComplete === true`, inspect errors, and disclose skipped checks. Suppression writes source and is not remediation.
 
 ---
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "praxis-sec",
-  "version": "1.2.1",
-  "description": "Praxis — From finding to fix, on autopilot. AI-native security CLI with 28 parallel agents covering AI / MCP / skill threats, OWASP LLM Top 10, multi-source supply-chain intel (OSV / GHSA / KEV / EPSS / NVD / Gitleaks + optional paid feeds), secret scanning, and an LLM-powered agentic remediation loop.",
+  "version": "1.2.4",
+  "description": "Praxis security CLI: 28 built-in scanners for AI apps, agents, MCP and code; local static analysis, optional LLM-assisted fixes, verification, threat intelligence and CI gates.",
   "main": "cli/index.js",
   "bin": {
     "praxis": "cli/bin/praxis.js"
@@ -11,8 +11,9 @@
     "test": "node --test cli/__tests__/intel.test.js cli/__tests__/agents.test.js cli/__tests__/core.test.js cli/__tests__/standards.test.js cli/__tests__/model-file-scanner.test.js cli/__tests__/prompt-injection-prober.test.js cli/__tests__/ast-engine.test.js cli/__tests__/benchmark.test.js cli/__tests__/redteam.test.js cli/__tests__/html-reporter.test.js cli/__tests__/scan-fingerprint.test.js cli/__tests__/fix-ledger.test.js cli/__tests__/threatpack-probes.test.js cli/__tests__/score-history.test.js cli/__tests__/web-ui.test.js cli/__tests__/rule-portability.test.js cli/__tests__/git-remote.test.js cli/__tests__/release-reliability.test.js",
     "test:determinism": "node scripts/check-determinism.mjs .",
     "lint": "eslint cli/",
+    "release:check": "node scripts/release-check.mjs",
     "praxis": "node cli/bin/praxis.js",
-    "prepublishOnly": "npm test && npm run lint && npm run test:determinism"
+    "prepublishOnly": "node scripts/release-check.mjs --publishing"
   },
   "keywords": [
     "security",
@@ -55,6 +56,7 @@
     "ai-defense/",
     "docs/",
     "!docs/internal/",
+    "assets/",
     "scripts/check-determinism.mjs",
     "README.md",
     "LICENSE"
@@ -62,8 +64,8 @@
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
-    "fast-glob": "^3.3.3",
     "ora": "^8.0.1",
+    "tinyglobby": "^0.2.17",
     "write-file-atomic": "^5.0.1"
   },
   "devDependencies": {

package/snippets/README.md

@@ -1,5 +1,11 @@
 # Security Snippets
 
+> These examples are illustrative and require adaptation and tests. Prompt text,
+> keyword filters, and in-memory limits do not enforce authorization or tenant
+> isolation. Apply access controls, tool restrictions, and resource limits in code;
+> test the deployed system against its actual threat model.
+
+
 **Copy-paste code blocks for common security patterns.**
 
 This folder contains drop-in code snippets for securing your application. Each snippet is heavily commented to explain *why* it works.