secureflow-cli 2.4.1 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +306 -302
- package/dist/git.d.ts +4 -0
- package/dist/git.d.ts.map +1 -1
- package/dist/git.js +12 -0
- package/dist/git.js.map +1 -1
- package/dist/lib/audio-player.d.ts.map +1 -1
- package/dist/lib/audio-player.js +20 -11
- package/dist/lib/audio-player.js.map +1 -1
- package/dist/mcp/index.d.ts.map +1 -1
- package/dist/mcp/index.js +28 -4
- package/dist/mcp/index.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,302 +1,306 @@
|
|
|
1
|
-
# 🛡️ SecureFlow CLI (`secureflow-cli`)
|
|
2
|
-
|
|
3
|
-
[](https://www.npmjs.com/package/secureflow-cli)
|
|
4
|
-
[](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE)
|
|
5
|
-
[](https://www.typescriptlang.org/)
|
|
6
|
-
[](https://modelcontextprotocol.io/)
|
|
7
|
-
|
|
8
|
-
**Pre-commit secret logging detector, AI vulnerability scanner, and Threat Intelligence MCP Server for modern developer workflows.**
|
|
9
|
-
|
|
10
|
-
The SecureFlow CLI intercepts code vulnerabilities and exposed secrets right at the developer terminal before commits reach remote repositories. It operates in both cloud-assisted and completely offline / air-gapped modes, features audio debriefs, and acts as an MCP server for AI coding assistants.
|
|
11
|
-
|
|
12
|
-
---
|
|
13
|
-
|
|
14
|
-
## 📋 Table of Contents
|
|
15
|
-
|
|
16
|
-
- [🌟 Features](#-features)
|
|
17
|
-
- [📦 Installation](#-installation)
|
|
18
|
-
- [🚀 Quick Start](#-quick-start)
|
|
19
|
-
- [🪝 Git Hook Setup (Husky)](#-git-hook-setup-husky)
|
|
20
|
-
- [📖 Command Line Reference](#-command-line-reference)
|
|
21
|
-
- [Options & Flags](#options--flags)
|
|
22
|
-
- [Failure Thresholds (`--fail-on`)](#failure-thresholds---fail-on)
|
|
23
|
-
- [Multi-Format Reports (`--format`)](#multi-format-reports---format)
|
|
24
|
-
- [🔒 Air-Gapped & Local Mode (`--local`)](#-air-gapped--local-mode---local)
|
|
25
|
-
- [🎙️ Audio Summary Debriefs (`--voice`)](#️-audio-summary-debriefs---voice)
|
|
26
|
-
- [🤖 Threat Intelligence MCP Server (`mcp`)](#-threat-intelligence-mcp-server-mcp)
|
|
27
|
-
- [Connecting to Cursor / Windsurf / Claude Desktop](#connecting-to-cursor--windsurf--claude-desktop)
|
|
28
|
-
- [Available MCP Tools](#available-mcp-tools)
|
|
29
|
-
- [⚙️ Configuration (`.secureflowignore`)](#️-configuration-secureflowignore)
|
|
30
|
-
- [🔄 CI/CD Pipeline Integration](#-cicd-pipeline-integration)
|
|
31
|
-
- [📄 License](#-license)
|
|
32
|
-
|
|
33
|
-
---
|
|
34
|
-
|
|
35
|
-
## 🌟 Features
|
|
36
|
-
|
|
37
|
-
- **⚡ Instant Pre-Commit Scans**: Evaluates staged git files in milliseconds to prevent accidental secret leaks and credential logging.
|
|
38
|
-
- **🧠 Hybrid AI Security Analysis**: Combines deterministic heuristic pattern matching with LLM-backed vulnerability reasoning.
|
|
39
|
-
- **🔐 Air-Gapped / Zero-Upload Mode**: Run with `--local` to guarantee that code snippets never leave your workstation.
|
|
40
|
-
- **🎙️ Voice Debriefs (`--voice` / `-v`)**: Audio debriefs of scan findings directly in your terminal upon scan completion, with automatic headless CI bypass.
|
|
41
|
-
- **🤖 Built-in MCP Server**: `secureflow mcp` exposes live threat intelligence, CVE lookups, and ArmorIQ cryptographic intent verification over JSON-RPC stdio.
|
|
42
|
-
- **📊 Comprehensive Exporters**: Export audit-grade reports in **SARIF** (GitHub Code Scanning), **HTML**, **CSV** (formula injection hardened), **JSON**, and **Markdown**.
|
|
43
|
-
- **🚦 Configurable Quality Gates**: Strict build-failing control using `--fail-on <low|medium|high|critical>`.
|
|
44
|
-
|
|
45
|
-
---
|
|
46
|
-
|
|
47
|
-
## 📦 Installation
|
|
48
|
-
|
|
49
|
-
### Global Installation (Recommended)
|
|
50
|
-
|
|
51
|
-
```bash
|
|
52
|
-
npm install -g secureflow-cli
|
|
53
|
-
```
|
|
54
|
-
|
|
55
|
-
### Project Dev Dependency
|
|
56
|
-
|
|
57
|
-
```bash
|
|
58
|
-
npm install --save-dev secureflow-cli
|
|
59
|
-
```
|
|
60
|
-
|
|
61
|
-
### Run Instantly via `npx`
|
|
62
|
-
|
|
63
|
-
```bash
|
|
64
|
-
npx secureflow --help
|
|
65
|
-
```
|
|
66
|
-
|
|
67
|
-
---
|
|
68
|
-
|
|
69
|
-
## 🚀 Quick Start
|
|
70
|
-
|
|
71
|
-
1. **Stage your changes in git:**
|
|
72
|
-
|
|
73
|
-
```bash
|
|
74
|
-
git add src/
|
|
75
|
-
```
|
|
76
|
-
|
|
77
|
-
2. **Run the security scanner:**
|
|
78
|
-
|
|
79
|
-
```bash
|
|
80
|
-
secureflow
|
|
81
|
-
```
|
|
82
|
-
|
|
83
|
-
3. **Run with an audio summary debrief:**
|
|
84
|
-
|
|
85
|
-
```bash
|
|
86
|
-
secureflow --voice
|
|
87
|
-
```
|
|
88
|
-
|
|
89
|
-
4. **Export a SARIF report for GitHub Code Scanning:**
|
|
90
|
-
```bash
|
|
91
|
-
secureflow --format sarif -o results.sarif
|
|
92
|
-
```
|
|
93
|
-
|
|
94
|
-
---
|
|
95
|
-
|
|
96
|
-
## 🪝 Git Hook Setup (Husky)
|
|
97
|
-
|
|
98
|
-
Prevent sensitive data from ever entering your git history by configuring SecureFlow in your pre-commit hook:
|
|
99
|
-
|
|
100
|
-
```bash
|
|
101
|
-
# Initialize husky in your project
|
|
102
|
-
npx husky init
|
|
103
|
-
|
|
104
|
-
# Add secureflow to your pre-commit hook
|
|
105
|
-
echo "npx secureflow --fail-on high" > .husky/pre-commit
|
|
106
|
-
```
|
|
107
|
-
|
|
108
|
-
Now, every `git commit` automatically triggers a security check on staged files. If a high or critical finding is detected, the commit is safely blocked.
|
|
109
|
-
|
|
110
|
-
---
|
|
111
|
-
|
|
112
|
-
## 📖 Command Line Reference
|
|
113
|
-
|
|
114
|
-
```text
|
|
115
|
-
Usage:
|
|
116
|
-
secureflow [options]
|
|
117
|
-
secureflow mcp [options]
|
|
118
|
-
|
|
119
|
-
Commands:
|
|
120
|
-
mcp Start the Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
121
|
-
```
|
|
122
|
-
|
|
123
|
-
### Options & Flags
|
|
124
|
-
|
|
125
|
-
| Flag | Shorthand | Default | Description |
|
|
126
|
-
| :--------------------- | :-------- | :------------------ | :------------------------------------------------------------------------------------------------- |
|
|
127
|
-
| `--fail-on <level>` | | `medium` | Exit with error code `1` if findings meet or exceed severity (`low`, `medium`, `high`, `critical`) |
|
|
128
|
-
| `--format <format>` | | `text` | Output report format: `text`, `json`, `sarif`, `csv`, `html`, `markdown` |
|
|
129
|
-
| `--output <path>` | `-o` | `stdout` | Write report to the specified file path |
|
|
130
|
-
| `--voice` | `-v` | `false` | Play an audio debrief of findings in your terminal upon completion |
|
|
131
|
-
| `--local` | | `false` | Skip cloud AI upload and run fully local pattern analysis |
|
|
132
|
-
| `--local-model <tag>` | | `llama3` | Specify local model tag when using local AI providers |
|
|
133
|
-
| `--ignore-file <path>` | | `.secureflowignore` | Custom path to ignore configuration file |
|
|
134
|
-
| `--dry-run` | | `false` | Simulate scan execution without writing output files |
|
|
135
|
-
| `--verbose` | | `false` | Enable verbose diagnostic logging |
|
|
136
|
-
| `--help` | `-h` | | Display CLI usage instructions and exit |
|
|
137
|
-
|
|
138
|
-
---
|
|
139
|
-
|
|
140
|
-
### Failure Thresholds (`--fail-on`)
|
|
141
|
-
|
|
142
|
-
Control the sensitivity of the pre-commit gate:
|
|
143
|
-
|
|
144
|
-
```bash
|
|
145
|
-
# Block only on high and critical findings (standard CI recommendation)
|
|
146
|
-
secureflow --fail-on high
|
|
147
|
-
|
|
148
|
-
# Strict zero-tolerance gate (blocks on any finding, including low)
|
|
149
|
-
secureflow --fail-on low
|
|
150
|
-
|
|
151
|
-
# Allow commits while logging warnings
|
|
152
|
-
secureflow --fail-on none
|
|
153
|
-
```
|
|
154
|
-
|
|
155
|
-
---
|
|
156
|
-
|
|
157
|
-
### Multi-Format Reports (`--format`)
|
|
158
|
-
|
|
159
|
-
- **Text (`text`)**: Clean, ANSI-colored terminal overview with source code context snippets.
|
|
160
|
-
- **SARIF (`sarif`)**: Industry-standard OASIS SARIF 2.1.0 format, ready for direct upload to GitHub Security tab.
|
|
161
|
-
- **HTML (`html`)**: Self-contained, responsive HTML report suitable for sharing and compliance reviews.
|
|
162
|
-
- **CSV (`csv`)**: Formatted tabular output hardened against spreadsheet formula injection (CWE-1236).
|
|
163
|
-
- **JSON (`json`)**: Machine-readable JSON object representing findings and metadata.
|
|
164
|
-
- **Markdown (`markdown` / `md`)**: GitHub-Flavored Markdown table with sanitized code fences.
|
|
165
|
-
|
|
166
|
-
```bash
|
|
167
|
-
secureflow --format html -o security-report.html
|
|
168
|
-
secureflow --format sarif -o results.sarif
|
|
169
|
-
secureflow --format markdown -o findings.md
|
|
170
|
-
```
|
|
171
|
-
|
|
172
|
-
---
|
|
173
|
-
|
|
174
|
-
## 🔒 Air-Gapped & Local Mode (`--local`)
|
|
175
|
-
|
|
176
|
-
When handling proprietary or classified source code, use the `--local` flag:
|
|
177
|
-
|
|
178
|
-
```bash
|
|
179
|
-
secureflow --local
|
|
180
|
-
```
|
|
181
|
-
|
|
182
|
-
### Guarantees under `--local`:
|
|
183
|
-
|
|
184
|
-
- **Zero Cloud Uploads**: The hosted AI API pass (`/api/cli/scan`) is completely bypassed.
|
|
185
|
-
- **Staged Code Stays Local**: File contents are parsed and scanned strictly in-memory on your local machine.
|
|
186
|
-
- **Compatible with Local Models**: Seamlessly pairs with local Ollama or vLLM deployments (`--local-model <tag>`).
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
secureflow
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
-
|
|
206
|
-
-
|
|
207
|
-
-
|
|
208
|
-
- **
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
```
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
}
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
|
240
|
-
|
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
|
|
262
|
-
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
|
|
268
|
-
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
273
|
-
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
|
|
279
|
-
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
287
|
-
|
|
288
|
-
|
|
289
|
-
|
|
290
|
-
|
|
291
|
-
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
|
|
295
|
-
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
1
|
+
# 🛡️ SecureFlow CLI (`secureflow-cli`)
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/secureflow-cli)
|
|
4
|
+
[](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE)
|
|
5
|
+
[](https://www.typescriptlang.org/)
|
|
6
|
+
[](https://modelcontextprotocol.io/)
|
|
7
|
+
|
|
8
|
+
**Pre-commit secret logging detector, AI vulnerability scanner, and Threat Intelligence MCP Server for modern developer workflows.**
|
|
9
|
+
|
|
10
|
+
The SecureFlow CLI intercepts code vulnerabilities and exposed secrets right at the developer terminal before commits reach remote repositories. It operates in both cloud-assisted and completely offline / air-gapped modes, features audio debriefs, and acts as an MCP server for AI coding assistants.
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## 📋 Table of Contents
|
|
15
|
+
|
|
16
|
+
- [🌟 Features](#-features)
|
|
17
|
+
- [📦 Installation](#-installation)
|
|
18
|
+
- [🚀 Quick Start](#-quick-start)
|
|
19
|
+
- [🪝 Git Hook Setup (Husky)](#-git-hook-setup-husky)
|
|
20
|
+
- [📖 Command Line Reference](#-command-line-reference)
|
|
21
|
+
- [Options & Flags](#options--flags)
|
|
22
|
+
- [Failure Thresholds (`--fail-on`)](#failure-thresholds---fail-on)
|
|
23
|
+
- [Multi-Format Reports (`--format`)](#multi-format-reports---format)
|
|
24
|
+
- [🔒 Air-Gapped & Local Mode (`--local`)](#-air-gapped--local-mode---local)
|
|
25
|
+
- [🎙️ Audio Summary Debriefs (`--voice`)](#️-audio-summary-debriefs---voice)
|
|
26
|
+
- [🤖 Threat Intelligence MCP Server (`mcp`)](#-threat-intelligence-mcp-server-mcp)
|
|
27
|
+
- [Connecting to Cursor / Windsurf / Claude Desktop](#connecting-to-cursor--windsurf--claude-desktop)
|
|
28
|
+
- [Available MCP Tools](#available-mcp-tools)
|
|
29
|
+
- [⚙️ Configuration (`.secureflowignore`)](#️-configuration-secureflowignore)
|
|
30
|
+
- [🔄 CI/CD Pipeline Integration](#-cicd-pipeline-integration)
|
|
31
|
+
- [📄 License](#-license)
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## 🌟 Features
|
|
36
|
+
|
|
37
|
+
- **⚡ Instant Pre-Commit Scans**: Evaluates staged git files in milliseconds to prevent accidental secret leaks and credential logging.
|
|
38
|
+
- **🧠 Hybrid AI Security Analysis**: Combines deterministic heuristic pattern matching with LLM-backed vulnerability reasoning.
|
|
39
|
+
- **🔐 Air-Gapped / Zero-Upload Mode**: Run with `--local` to guarantee that code snippets never leave your workstation.
|
|
40
|
+
- **🎙️ Voice Debriefs (`--voice` / `-v`)**: Audio debriefs of scan findings directly in your terminal upon scan completion, with automatic headless CI bypass.
|
|
41
|
+
- **🤖 Built-in MCP Server**: `secureflow mcp` exposes live threat intelligence, CVE lookups, and ArmorIQ cryptographic intent verification over JSON-RPC stdio.
|
|
42
|
+
- **📊 Comprehensive Exporters**: Export audit-grade reports in **SARIF** (GitHub Code Scanning), **HTML**, **CSV** (formula injection hardened), **JSON**, and **Markdown**.
|
|
43
|
+
- **🚦 Configurable Quality Gates**: Strict build-failing control using `--fail-on <low|medium|high|critical>`.
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## 📦 Installation
|
|
48
|
+
|
|
49
|
+
### Global Installation (Recommended)
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npm install -g secureflow-cli
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
### Project Dev Dependency
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
npm install --save-dev secureflow-cli
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
### Run Instantly via `npx`
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
npx secureflow --help
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## 🚀 Quick Start
|
|
70
|
+
|
|
71
|
+
1. **Stage your changes in git:**
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
git add src/
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
2. **Run the security scanner:**
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
secureflow
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
3. **Run with an audio summary debrief:**
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
secureflow --voice
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
4. **Export a SARIF report for GitHub Code Scanning:**
|
|
90
|
+
```bash
|
|
91
|
+
secureflow --format sarif -o results.sarif
|
|
92
|
+
```
|
|
93
|
+
|
|
94
|
+
---
|
|
95
|
+
|
|
96
|
+
## 🪝 Git Hook Setup (Husky)
|
|
97
|
+
|
|
98
|
+
Prevent sensitive data from ever entering your git history by configuring SecureFlow in your pre-commit hook:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
# Initialize husky in your project
|
|
102
|
+
npx husky init
|
|
103
|
+
|
|
104
|
+
# Add secureflow to your pre-commit hook
|
|
105
|
+
echo "npx secureflow --fail-on high" > .husky/pre-commit
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
Now, every `git commit` automatically triggers a security check on staged files. If a high or critical finding is detected, the commit is safely blocked.
|
|
109
|
+
|
|
110
|
+
---
|
|
111
|
+
|
|
112
|
+
## 📖 Command Line Reference
|
|
113
|
+
|
|
114
|
+
```text
|
|
115
|
+
Usage:
|
|
116
|
+
secureflow [options]
|
|
117
|
+
secureflow mcp [options]
|
|
118
|
+
|
|
119
|
+
Commands:
|
|
120
|
+
mcp Start the Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
### Options & Flags
|
|
124
|
+
|
|
125
|
+
| Flag | Shorthand | Default | Description |
|
|
126
|
+
| :--------------------- | :-------- | :------------------ | :------------------------------------------------------------------------------------------------- |
|
|
127
|
+
| `--fail-on <level>` | | `medium` | Exit with error code `1` if findings meet or exceed severity (`low`, `medium`, `high`, `critical`) |
|
|
128
|
+
| `--format <format>` | | `text` | Output report format: `text`, `json`, `sarif`, `csv`, `html`, `markdown` |
|
|
129
|
+
| `--output <path>` | `-o` | `stdout` | Write report to the specified file path |
|
|
130
|
+
| `--voice` | `-v` | `false` | Play an audio debrief of findings in your terminal upon completion |
|
|
131
|
+
| `--local` | | `false` | Skip cloud AI upload and run fully local pattern analysis |
|
|
132
|
+
| `--local-model <tag>` | | `llama3` | Specify local model tag when using local AI providers |
|
|
133
|
+
| `--ignore-file <path>` | | `.secureflowignore` | Custom path to ignore configuration file |
|
|
134
|
+
| `--dry-run` | | `false` | Simulate scan execution without writing output files |
|
|
135
|
+
| `--verbose` | | `false` | Enable verbose diagnostic logging |
|
|
136
|
+
| `--help` | `-h` | | Display CLI usage instructions and exit |
|
|
137
|
+
|
|
138
|
+
---
|
|
139
|
+
|
|
140
|
+
### Failure Thresholds (`--fail-on`)
|
|
141
|
+
|
|
142
|
+
Control the sensitivity of the pre-commit gate:
|
|
143
|
+
|
|
144
|
+
```bash
|
|
145
|
+
# Block only on high and critical findings (standard CI recommendation)
|
|
146
|
+
secureflow --fail-on high
|
|
147
|
+
|
|
148
|
+
# Strict zero-tolerance gate (blocks on any finding, including low)
|
|
149
|
+
secureflow --fail-on low
|
|
150
|
+
|
|
151
|
+
# Allow commits while logging warnings
|
|
152
|
+
secureflow --fail-on none
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
### Multi-Format Reports (`--format`)
|
|
158
|
+
|
|
159
|
+
- **Text (`text`)**: Clean, ANSI-colored terminal overview with source code context snippets.
|
|
160
|
+
- **SARIF (`sarif`)**: Industry-standard OASIS SARIF 2.1.0 format, ready for direct upload to GitHub Security tab.
|
|
161
|
+
- **HTML (`html`)**: Self-contained, responsive HTML report suitable for sharing and compliance reviews.
|
|
162
|
+
- **CSV (`csv`)**: Formatted tabular output hardened against spreadsheet formula injection (CWE-1236).
|
|
163
|
+
- **JSON (`json`)**: Machine-readable JSON object representing findings and metadata.
|
|
164
|
+
- **Markdown (`markdown` / `md`)**: GitHub-Flavored Markdown table with sanitized code fences.
|
|
165
|
+
|
|
166
|
+
```bash
|
|
167
|
+
secureflow --format html -o security-report.html
|
|
168
|
+
secureflow --format sarif -o results.sarif
|
|
169
|
+
secureflow --format markdown -o findings.md
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
---
|
|
173
|
+
|
|
174
|
+
## 🔒 Air-Gapped & Local Mode (`--local`)
|
|
175
|
+
|
|
176
|
+
When handling proprietary or classified source code, use the `--local` flag:
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
secureflow --local
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
### Guarantees under `--local`:
|
|
183
|
+
|
|
184
|
+
- **Zero Cloud Uploads**: The hosted AI API pass (`/api/cli/scan`) is completely bypassed.
|
|
185
|
+
- **Staged Code Stays Local**: File contents are parsed and scanned strictly in-memory on your local machine.
|
|
186
|
+
- **Compatible with Local Models**: Seamlessly pairs with local Ollama or vLLM deployments (`--local-model <tag>`).
|
|
187
|
+
|
|
188
|
+
For hardware requirements, VRAM sizing, and fallback configuration, see the [Local Model & VRAM Guide](../docs/local-inference.md).
|
|
189
|
+
|
|
190
|
+
---
|
|
191
|
+
|
|
192
|
+
## 🎙️ Audio Summary Debriefs (`--voice`)
|
|
193
|
+
|
|
194
|
+
Listen to hands-free voice briefings of scan findings right in your terminal:
|
|
195
|
+
|
|
196
|
+
```bash
|
|
197
|
+
secureflow --voice
|
|
198
|
+
# or shorthand
|
|
199
|
+
secureflow -v
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
### Capabilities:
|
|
203
|
+
|
|
204
|
+
- **Native OS Playback**:
|
|
205
|
+
- macOS: `afplay`
|
|
206
|
+
- Windows: PowerShell `System.Media.SoundPlayer` / `Windows.Media.Playback`
|
|
207
|
+
- Linux: `mpg123` or `aplay`
|
|
208
|
+
- **Fallback**: Automatically saves findings to `secureflow-summary.mp3` if no audio player is present.
|
|
209
|
+
- **CI Safe**: Detects non-interactive environments (`CI=true`, `GITHUB_ACTIONS=true`) and silently skips playback without stalling build runners.
|
|
210
|
+
- **ElevenLabs Integration**: Synthesizes natural voice summaries if `ELEVENLABS_API_KEY` is present.
|
|
211
|
+
|
|
212
|
+
---
|
|
213
|
+
|
|
214
|
+
## 🤖 Threat Intelligence MCP Server (`mcp`)
|
|
215
|
+
|
|
216
|
+
SecureFlow CLI doubles as a **Model Context Protocol (MCP)** server, allowing AI agents in **Cursor**, **Windsurf**, **Claude Desktop**, or **Antigravity** to query threat intelligence and verify tool actions against ArmorIQ policy boundaries.
|
|
217
|
+
|
|
218
|
+
```bash
|
|
219
|
+
secureflow mcp
|
|
220
|
+
```
|
|
221
|
+
|
|
222
|
+
### Connecting to Cursor / Windsurf / Claude Desktop
|
|
223
|
+
|
|
224
|
+
Add this configuration to your `claude_desktop_config.json` or Cursor MCP settings:
|
|
225
|
+
|
|
226
|
+
```json
|
|
227
|
+
{
|
|
228
|
+
"mcpServers": {
|
|
229
|
+
"secureflow": {
|
|
230
|
+
"command": "npx",
|
|
231
|
+
"args": ["-y", "secureflow-cli", "mcp"]
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
}
|
|
235
|
+
```
|
|
236
|
+
|
|
237
|
+
### Available MCP Tools
|
|
238
|
+
|
|
239
|
+
| Tool | Parameters | Description |
|
|
240
|
+
| :-------------------------- | :-------------------------------------- | :------------------------------------------------------------------------------------------ |
|
|
241
|
+
| `query_threat_intelligence` | `query: string`, `intentToken?: string` | Search CVE and threat intelligence databases for vulnerabilities and remediation guidance. |
|
|
242
|
+
| `lookup_cve` | `cveId: string`, `intentToken?: string` | Look up detailed advisories, severity scores, and fix patterns for a CVE or CWE identifier. |
|
|
243
|
+
|
|
244
|
+
_All MCP tool calls are gated behind ArmorIQ cryptographic intent verification to enforce zero-trust boundary compliance and mitigate Prompt Injection (CWE-94)._
|
|
245
|
+
|
|
246
|
+
For comprehensive IDE configuration steps, intent signing keys, and manual testing instructions, see the dedicated [Threat Intelligence MCP Server Guide](../docs/mcp-server.md).
|
|
247
|
+
|
|
248
|
+
---
|
|
249
|
+
|
|
250
|
+
## ⚙️ Configuration (`.secureflowignore`)
|
|
251
|
+
|
|
252
|
+
Define exclusion patterns and placeholder allowances in `.secureflowignore` at the root of your project:
|
|
253
|
+
|
|
254
|
+
```gitignore
|
|
255
|
+
# Ignore specific directories and generated bundles
|
|
256
|
+
dist/
|
|
257
|
+
coverage/
|
|
258
|
+
node_modules/
|
|
259
|
+
*.min.js
|
|
260
|
+
|
|
261
|
+
# Ignore documentation examples
|
|
262
|
+
docs/samples/**
|
|
263
|
+
|
|
264
|
+
# Allow safe mock/test tokens
|
|
265
|
+
[placeholders]
|
|
266
|
+
mock-token-*
|
|
267
|
+
test_api_key_dummy
|
|
268
|
+
EXAMPLE_SECRET
|
|
269
|
+
```
|
|
270
|
+
|
|
271
|
+
---
|
|
272
|
+
|
|
273
|
+
## 🔄 CI/CD Pipeline Integration
|
|
274
|
+
|
|
275
|
+
### GitHub Actions Workflow
|
|
276
|
+
|
|
277
|
+
```yaml
|
|
278
|
+
name: Security Scan
|
|
279
|
+
on: [push, pull_request]
|
|
280
|
+
|
|
281
|
+
jobs:
|
|
282
|
+
secureflow-scan:
|
|
283
|
+
runs-on: ubuntu-latest
|
|
284
|
+
steps:
|
|
285
|
+
- uses: actions/checkout@v4
|
|
286
|
+
|
|
287
|
+
- name: Setup Node.js
|
|
288
|
+
uses: actions/setup-node@v4
|
|
289
|
+
with:
|
|
290
|
+
node-version: 20
|
|
291
|
+
|
|
292
|
+
- name: Run SecureFlow Scanner
|
|
293
|
+
run: npx secureflow-cli --format sarif -o results.sarif --fail-on high
|
|
294
|
+
|
|
295
|
+
- name: Upload SARIF to GitHub Security tab
|
|
296
|
+
if: always()
|
|
297
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
298
|
+
with:
|
|
299
|
+
sarif_file: results.sarif
|
|
300
|
+
```
|
|
301
|
+
|
|
302
|
+
---
|
|
303
|
+
|
|
304
|
+
## 📄 License
|
|
305
|
+
|
|
306
|
+
This package is licensed under the [ISC License](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE). Built with ❤️ by the SecureFlow Team.
|
package/dist/git.d.ts
CHANGED
|
@@ -48,4 +48,8 @@ export declare function getStagedFiles(): string[];
|
|
|
48
48
|
* a symlink), so the caller can report it rather than treat it as clean.
|
|
49
49
|
*/
|
|
50
50
|
export declare function readStagedContent(path: string): string | null;
|
|
51
|
+
/**
|
|
52
|
+
* Detects the currently checked out branch name, or null if detached or outside git repository.
|
|
53
|
+
*/
|
|
54
|
+
export declare function getCurrentBranch(): string | null;
|
|
51
55
|
//# sourceMappingURL=git.d.ts.map
|
package/dist/git.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IAG/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBADxB,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,OAAO,YAAA;CAK3B;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D"}
|
|
1
|
+
{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IAG/B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBADxB,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,OAAO,YAAA;CAK3B;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAOhD"}
|
package/dist/git.js
CHANGED
|
@@ -93,4 +93,16 @@ export function readStagedContent(path) {
|
|
|
93
93
|
return null;
|
|
94
94
|
}
|
|
95
95
|
}
|
|
96
|
+
/**
|
|
97
|
+
* Detects the currently checked out branch name, or null if detached or outside git repository.
|
|
98
|
+
*/
|
|
99
|
+
export function getCurrentBranch() {
|
|
100
|
+
try {
|
|
101
|
+
const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]).trim();
|
|
102
|
+
return branch === "HEAD" || branch.length === 0 ? null : branch;
|
|
103
|
+
}
|
|
104
|
+
catch {
|
|
105
|
+
return null;
|
|
106
|
+
}
|
|
107
|
+
}
|
|
96
108
|
//# sourceMappingURL=git.js.map
|
package/dist/git.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGtB;IAFX,YACE,OAAe,EACN,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGtB;IAFX,YACE,OAAe,EACN,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEpF;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,cAA4B,GAAG,OAAO,
|
|
1
|
+
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEpF;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,cAA4B,GAAG,OAAO,CAcxF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA8B5C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,mBAAmB,CAwCrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuExB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUzD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,GACA,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}
|
package/dist/lib/audio-player.js
CHANGED
|
@@ -14,7 +14,10 @@ export function isNonInteractiveCiEnvironment(env = process.env) {
|
|
|
14
14
|
env.CIRCLECI ||
|
|
15
15
|
env.TRAVIS ||
|
|
16
16
|
env.CONTINUOUS_INTEGRATION ||
|
|
17
|
-
env.BUILDKITE
|
|
17
|
+
env.BUILDKITE ||
|
|
18
|
+
env.DOCKER === "true" ||
|
|
19
|
+
env.DOCKER_CONTAINER === "true" ||
|
|
20
|
+
env.container === "docker");
|
|
18
21
|
}
|
|
19
22
|
/**
|
|
20
23
|
* Determines the command and arguments for native OS audio playback.
|
|
@@ -25,16 +28,16 @@ export function getOsAudioCommand(filePath, platform = process.platform) {
|
|
|
25
28
|
return { command: "afplay", args: [filePath] };
|
|
26
29
|
case "win32": {
|
|
27
30
|
// PowerShell sound player: uses SoundPlayer for .wav or MediaPlayer / wmplayer fallback
|
|
28
|
-
const psScript = `
|
|
29
|
-
try {
|
|
30
|
-
Add-Type -AssemblyName presentationCore;
|
|
31
|
-
$player = New-Object System.Windows.Media.MediaPlayer;
|
|
32
|
-
$player.Open([System.Uri]'${filePath.replace(/'/g, "''")}');
|
|
33
|
-
$player.Play();
|
|
34
|
-
Start-Sleep -Seconds 1;
|
|
35
|
-
} catch {
|
|
36
|
-
[System.Media.SystemSounds]::Beep.Play();
|
|
37
|
-
}
|
|
31
|
+
const psScript = `
|
|
32
|
+
try {
|
|
33
|
+
Add-Type -AssemblyName presentationCore;
|
|
34
|
+
$player = New-Object System.Windows.Media.MediaPlayer;
|
|
35
|
+
$player.Open([System.Uri]'${filePath.replace(/'/g, "''")}');
|
|
36
|
+
$player.Play();
|
|
37
|
+
Start-Sleep -Seconds 1;
|
|
38
|
+
} catch {
|
|
39
|
+
[System.Media.SystemSounds]::Beep.Play();
|
|
40
|
+
}
|
|
38
41
|
`
|
|
39
42
|
.replace(/\s+/g, " ")
|
|
40
43
|
.trim();
|
|
@@ -120,6 +123,12 @@ export async function fetchAudioSummary(summaryText, options) {
|
|
|
120
123
|
const arrayBuf = await response.arrayBuffer();
|
|
121
124
|
return Buffer.from(arrayBuf);
|
|
122
125
|
}
|
|
126
|
+
if (response.status === 429) {
|
|
127
|
+
console.warn("⚠️ [SecureFlow] ElevenLabs rate limit reached (429 Too Many Requests).");
|
|
128
|
+
}
|
|
129
|
+
else if (response.status === 401) {
|
|
130
|
+
console.warn("⚠️ [SecureFlow] ElevenLabs authentication failed (401 Unauthorized). Check API key.");
|
|
131
|
+
}
|
|
123
132
|
}
|
|
124
133
|
catch {
|
|
125
134
|
// Fallback to /api/cli/scan
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAW9D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE,KAAK,MAAM;QACjB,GAAG,CAAC,EAAE,KAAK,GAAG;QACd,GAAG,CAAC,cAAc,KAAK,MAAM;QAC7B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,SAAS,
|
|
1
|
+
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAW9D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE,KAAK,MAAM;QACjB,GAAG,CAAC,EAAE,KAAK,GAAG;QACd,GAAG,CAAC,cAAc,KAAK,MAAM;QAC7B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,GAAG,CAAC,gBAAgB,KAAK,MAAM;QAC/B,GAAG,CAAC,SAAS,KAAK,QAAQ,CAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wFAAwF;YACxF,MAAM,QAAQ,GAAG;;;;sCAIe,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;;;;;;OAM3D;iBACE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,KAAK,OAAO;YACV,iCAAiC;YACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,OAKC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAElD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9C,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEtE,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,8DAA8D,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,OAIC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAEhD,2DAA2D;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,CAAC,CAAC,gBAAgB;YACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+CAA+C,OAAO,EAAE,EAAE;gBACrF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,gBAAgB;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,uBAAuB;oBACjC,cAAc,EAAE;wBACd,SAAS,EAAE,GAAG;wBACd,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAC1F,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CACV,sFAAsF,CACvF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC3B,KAAK,EAAE,IAAI;gBACX,WAAW;aACZ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6C,CAAC;YACjF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAQC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,EAAE,CAAC,MAAM,EAAE,EACX,sBAAsB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACjF,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC;IAElB,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/dist/mcp/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,uBAAuB,EA8CnD,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,cAAc,EAAE,uBAAuB,EA8CnD,CAAC;AAqBF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,MAAM,GACnB,wBAAwB,CA4D1B;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CA8InD;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBhF;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAKpD"}
|
package/dist/mcp/index.js
CHANGED
|
@@ -44,7 +44,19 @@ export const KNOWLEDGE_BASE = [
|
|
|
44
44
|
/**
|
|
45
45
|
* Creates and configures the SecureFlow Threat Intelligence MCP Server.
|
|
46
46
|
*/
|
|
47
|
-
|
|
47
|
+
/**
|
|
48
|
+
* Resolve the HMAC key used for MCP tool proofs.
|
|
49
|
+
*
|
|
50
|
+
* There is deliberately no built-in key. A committed default would let any
|
|
51
|
+
* reader of the repository forge proofs against a misconfigured deployment.
|
|
52
|
+
*/
|
|
53
|
+
function resolveSigningKey() {
|
|
54
|
+
const key = process.env.ARMORIQ_PROOF_SIGNING_KEY?.trim();
|
|
55
|
+
if (!key) {
|
|
56
|
+
throw new Error("ARMORIQ_PROOF_SIGNING_KEY is not configured; refusing to sign ArmorIQ proofs with a public fallback key.");
|
|
57
|
+
}
|
|
58
|
+
return key;
|
|
59
|
+
}
|
|
48
60
|
/**
|
|
49
61
|
* Validates declared cryptographic intent against ArmorIQ policy rules
|
|
50
62
|
* to prevent prompt injection (CWE-94) and arbitrary execution drift.
|
|
@@ -75,7 +87,19 @@ export function verifyDeclaredIntent(toolName, args, intentToken) {
|
|
|
75
87
|
const proofHash = createHash("sha256")
|
|
76
88
|
.update(JSON.stringify({ toolName, args, timestamp }))
|
|
77
89
|
.digest("hex");
|
|
78
|
-
|
|
90
|
+
let signature;
|
|
91
|
+
try {
|
|
92
|
+
signature = createHmac("sha256", resolveSigningKey()).update(proofHash).digest("hex");
|
|
93
|
+
}
|
|
94
|
+
catch (error) {
|
|
95
|
+
return {
|
|
96
|
+
verified: false,
|
|
97
|
+
allowed: false,
|
|
98
|
+
reason: error instanceof Error
|
|
99
|
+
? `Action blocked by ArmorIQ: ${error.message}`
|
|
100
|
+
: "Action blocked by ArmorIQ: signing key is not configured",
|
|
101
|
+
};
|
|
102
|
+
}
|
|
79
103
|
return {
|
|
80
104
|
verified: true,
|
|
81
105
|
allowed: true,
|
|
@@ -206,8 +230,8 @@ export async function queryLiveThreatIntelligence(query) {
|
|
|
206
230
|
item.category.toLowerCase().includes(q) ||
|
|
207
231
|
(item.cve && item.cve.toLowerCase().includes(q)));
|
|
208
232
|
if (match) {
|
|
209
|
-
return `[Threat Intelligence Advisory - ${match.id} (${match.severity.toUpperCase()})]
|
|
210
|
-
Category: ${match.category}
|
|
233
|
+
return `[Threat Intelligence Advisory - ${match.id} (${match.severity.toUpperCase()})]
|
|
234
|
+
Category: ${match.category}
|
|
211
235
|
Guidance: ${match.remediationGuidance}`;
|
|
212
236
|
}
|
|
213
237
|
return "";
|
package/dist/mcp/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAWnG,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,eAAe;QACzB,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,eAAe;QACpB,mBAAmB,EACjB,mHAAmH;KACtH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EACT,6IAA6I;QAC/I,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,mBAAmB,EACjB,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,oGAAoG;KACvG;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,kHAAkH;KACrH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EACT,wGAAwG;QAC1G,QAAQ,EAAE,UAAU;QACpB,mBAAmB,EACjB,oHAAoH;KACvH;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAWnG,MAAM,CAAC,MAAM,cAAc,GAA8B;IACvD;QACE,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,eAAe;QACzB,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,eAAe;QACpB,mBAAmB,EACjB,mHAAmH;KACtH;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,QAAQ,EAAE,6BAA6B;QACvC,WAAW,EACT,6IAA6I;QAC/I,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,gBAAgB;QACrB,mBAAmB,EACjB,+HAA+H;KAClI;IACD;QACE,EAAE,EAAE,cAAc;QAClB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iFAAiF;QAC9F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,oGAAoG;KACvG;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,QAAQ,EAAE,MAAM;QAChB,mBAAmB,EACjB,kHAAkH;KACrH;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,QAAQ,EAAE,kBAAkB;QAC5B,WAAW,EACT,wGAAwG;QAC1G,QAAQ,EAAE,UAAU;QACpB,mBAAmB,EACjB,oHAAoH;KACvH;CACF,CAAC;AAEF;;GAEG;AACH;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,IAA6B,EAC7B,WAAoB;IAEpB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEtD,kEAAkE;IAClE,IACE,iHAAiH,CAAC,IAAI,CACpH,UAAU,CACX;QACD,iGAAiG,CAAC,IAAI,CACpG,UAAU,CACX;QACD,2DAA2D,CAAC,IAAI,CAAC,UAAU,CAAC,EAC5E,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,wFAAwF;aAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;SACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EACJ,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,8BAA8B,KAAK,CAAC,OAAO,EAAE;gBAC/C,CAAC,CAAC,0DAA0D;SACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,KAAK,EAAE;YACL,SAAS;YACT,SAAS;YACT,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,OAAO;KACjB,EACD;QACE,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE;SACV;KACF,CACF,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,OAAO;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,2BAA2B;oBACjC,WAAW,EACT,yGAAyG;oBAC3G,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,WAAW,EACT,gGAAgG;6BACnG;4BACD,WAAW,EAAE;gCACX,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,qEAAqE;6BACnF;yBACF;wBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;qBACpB;iBACF;gBACD;oBACE,IAAI,EAAE,YAAY;oBAClB,WAAW,EACT,oGAAoG;oBACtG,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,mDAAmD;6BACjE;4BACD,WAAW,EAAE;gCACX,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,qEAAqE;6BACnF;yBACF;wBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;qBACpB;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,MAAM,WAAW,GAAI,IAAY,EAAE,WAAW,CAAC;QAE/C,4FAA4F;QAC5F,MAAM,kBAAkB,GAAG,oBAAoB,CAC7C,IAAI,EACH,IAAgC,IAAI,EAAE,EACvC,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,kBAAkB,CAAC,MAAM;4BAChC,IAAI,EAAE,oCAAoC;4BAC1C,WAAW,EAAE,aAAa;yBAC3B,CAAC;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,CAAE,IAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC3C,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACvD,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EACzD,IAAI,EACJ,CAAC,CACF;qBACF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAE,IAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAC5F,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;yBACrC;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,6BAA6B,KAAK,EAAE;4BAC3C,cAAc,EAAE,+DAA+D;yBAChF,CAAC;qBACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa;IAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAC/B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CACnD,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,mCAAmC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE;YAC3E,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,mBAAmB,EAAE,CAAC;IACtC,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;AAC/E,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7B,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "secureflow-cli",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.5.0",
|
|
4
4
|
"description": "Pre-commit secret logging detector for secure development workflows",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"bin": {
|
|
@@ -38,6 +38,6 @@
|
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@types/node": "^26.6.5",
|
|
40
40
|
"typescript": "^6",
|
|
41
|
-
"vitest": "^5.0.
|
|
41
|
+
"vitest": "^5.0.5"
|
|
42
42
|
}
|
|
43
43
|
}
|