security-mcp 1.0.1 → 1.0.2

package/dist/cli/install.js

@@ -102,6 +102,27 @@ function writeVsCodeSettings(configPath, dryRun) {
     }
     return configPath;
 }
+function installPolicy(dryRun) {
+    const policySrc = join(PKG_ROOT, "defaults", "security-policy.json");
+    const policyDest = join(process.cwd(), ".mcp", "policies", "security-policy.json");
+    const evidenceSrc = join(PKG_ROOT, "defaults", "evidence-map.json");
+    const evidenceDest = join(process.cwd(), ".mcp", "mappings", "evidence-map.json");
+    for (const { src, dest } of [{ src: policySrc, dest: policyDest }, { src: evidenceSrc, dest: evidenceDest }]) {
+        if (!existsSync(src)) {
+            process.stdout.write(`  [skip] ${src} not found in package\n`);
+            continue;
+        }
+        if (existsSync(dest)) {
+            process.stdout.write(`  [skip] already exists: ${dest}\n`);
+            continue;
+        }
+        if (!dryRun) {
+            mkdirSync(dirname(dest), { recursive: true });
+            copyFileSync(src, dest);
+        }
+        process.stdout.write(`  ${dryRun ? "[dry-run] would copy" : "installed"}: ${dest}\n`);
+    }
+}
 function installSkill(dryRun) {
     const skillSrc = join(PKG_ROOT, "skills", "senior-security-engineer", "SKILL.md");
     const skillDest = resolveHome("~/.claude/skills/senior-security-engineer/SKILL.md");
@@ -148,6 +169,8 @@ export async function runInstall(opts) {
         process.stdout.write("\nInstalling Claude Code skill...\n");
         installSkill(dryRun);
     }
+    process.stdout.write("\nInstalling security policy...\n");
+    installPolicy(dryRun);
     process.stdout.write("\n");
     process.stdout.write(dryRun
         ? "Dry-run complete. Re-run without --dry-run to apply.\n"
@@ -155,7 +178,5 @@ export async function runInstall(opts) {
     process.stdout.write("\nNext steps:\n");
     process.stdout.write("  1. Restart your editor.\n");
     process.stdout.write('  2. In Claude Code, type /senior-security-engineer to activate the security persona.\n');
-    process.stdout.write('  3. Ask your AI: "Run security.run_pr_gate" to check your current diff.\n');
-    process.stdout.write("  4. Copy defaults/security-policy.json to .mcp/policies/security-policy.json\n");
-    process.stdout.write("     and customize it for your project.\n\n");
+    process.stdout.write('  3. Ask your AI: "Run security.run_pr_gate" to check your current diff.\n\n');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-mcp",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "AI security MCP server and enforcement gate for Claude Code, Cursor, GitHub Copilot, Codex, Replit, and any MCP-compatible editor. Applies OWASP, MITRE ATT&CK, NIST, Zero Trust, PCI DSS, SOC 2, and ISO 27001.",
   "type": "module",
   "license": "MIT",