security-harness-kit 0.5.5 → 0.5.7

package/README.md

@@ -30,6 +30,7 @@ With `shk`, you can:
 - Install Git pre-commit hooks.
 - Install managed hooks for Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, and Windsurf.
 - Preview metadata-only audit logs to understand blocked hook activity without storing detected values.
+- Statically audit MCP client configurations for unsafe package, credential, HTTP, and filesystem settings.
 - Generate a GitHub Actions workflow that runs `shk scan` on every pull request.
 - Diagnose ignore file and `.env` safety coverage.
 - Deploy AI agent skills to Claude Code, Codex, Cursor, GitHub Copilot, Antigravity, and Windsurf project directories.
@@ -133,8 +134,32 @@ Generate a GitHub Actions workflow that scans every pull request:
 
 ```bash
 shk ci init github
+# Add GitHub code scanning alerts and PR annotations:
+shk ci init github --upload-sarif
 ```
 
+Alternatively, use the repository's composite action after checkout on a Linux or macOS runner:
+
+```yaml
+permissions:
+  contents: read
+  security-events: write
+
+steps:
+  - uses: actions/checkout@v6
+    with:
+      persist-credentials: false
+  - uses: Kazuki-tam/security-harness-kit@v1
+    with:
+      path: .
+      fail-on: high
+      upload-sarif: true
+```
+
+Set `upload-sarif: false` when GitHub code scanning is unavailable. Private repositories
+need GitHub Code Security enabled to upload SARIF. Pull requests from forks normally receive
+a read-only token; disable upload for those runs if the repository does not permit SARIF upload.
+
 Install the shk agent skill for Claude Code, Codex/Cursor, Copilot, Antigravity, and Windsurf:
 
 ```bash
@@ -191,6 +216,11 @@ shk audit --reason action-guard
 shk audit --since 7d --tool cursor
 shk audit --json
 
+shk mcp audit
+shk mcp audit --json
+shk mcp audit --sarif
+shk mcp audit --global
+
 shk env dotenvx import-keys .env.keys
 shk env encrypt .env --in-place
 shk env run -- npm test
@@ -210,9 +240,10 @@ shk hooks install-ai --tool antigravity
 shk hooks install-ai --tool windsurf
 
 shk ci init github
+shk ci init github --upload-sarif
 shk ci init github --dry-run
 shk ci init github --mode audit
-shk ci init github --shk-version v0.5.5
+shk ci init github --shk-version v0.5.7
 
 shk skills install
 shk skills install --tool claude-code --global
@@ -278,8 +309,8 @@ shk env key migrate --to 1password
 | Code | Meaning |
 |------|---------|
 | `0` | No findings at or above the active threshold, or command completed successfully. |
-| `1` | Scan findings met or exceeded the active threshold. |
-| `2` | Blocking AI pre-hook triggered, or a Git-specific scan mode was run outside a Git repository. |
+| `1` | Scan or MCP audit findings met or exceeded the active threshold. |
+| `2` | Blocking AI pre-hook triggered, or a scan/MCP audit runtime or configuration error occurred. |
 
 ## Safety Notes
 

package/npm-shrinkwrap.json

@@ -23,7 +23,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "security-harness-kit",
-      "version": "0.5.5"
+      "version": "0.5.7"
     },
     "node_modules/@isaacs/cliui": {
       "engines": {
@@ -542,5 +542,5 @@
     }
   },
   "requires": true,
-  "version": "0.5.5"
+  "version": "0.5.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.5.5"
+    "https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.5.7"
   ],
   "bin": {
     "shk": "run-shk.js"
@@ -85,7 +85,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.5.5",
+  "version": "0.5.7",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"