toolip 1.0.3 → 1.0.6

package/README.md

@@ -0,0 +1,599 @@
+# Toolip
+
+<p align="center">
+  <strong>Developer-First Supply Chain Security, Security Hygiene, and Secrets Management CLI</strong>
+</p>
+
+<p align="center">
+  Dependency Intelligence • Security Auditing • Secret Detection • Git Security • Learning Mode • Encrypted Vault
+</p>
+
+---
+
+## Overview
+
+Toolip is a TypeScript-powered developer security companion designed to help developers build safer software.
+
+Modern development relies heavily on third-party packages, environment variables, cloud credentials, CI/CD pipelines, and Git workflows. While security tooling often targets enterprise security teams, developers are frequently left with tools that identify problems without explaining them.
+
+Toolip takes a different approach.
+
+Instead of simply reporting findings, Toolip focuses on education, remediation guidance, and practical developer workflows.
+
+Toolip combines:
+
+* Supply Chain Security
+* Dependency Intelligence
+* Developer Security Auditing
+* Secret Detection
+* Git Security
+* Security Scorecards
+* Encrypted Local Secret Storage
+* Security Learning Resources
+
+Everything runs locally.
+
+No accounts.
+
+No dashboards.
+
+No SaaS.
+
+No subscriptions.
+
+---
+
+## Why Toolip?
+
+Most tools stop at:
+
+```text
+Security issue found.
+```
+
+Toolip goes further:
+
+* What is wrong?
+* Why does it matter?
+* How risky is it?
+* How do you fix it?
+* What alternatives exist?
+* How can you prevent it in future?
+
+The goal is to help developers understand security while improving security posture.
+
+---
+
+## Installation
+
+### npm
+
+```bash
+npm install -g toolip
+```
+
+Verify installation:
+
+```bash
+toolip --version
+```
+
+---
+
+## Quick Start
+
+Analyze a project:
+
+```bash
+toolip profile
+
+toolip scan
+
+toolip doctor
+
+toolip score
+```
+
+Review Git hygiene:
+
+```bash
+toolip git-audit
+
+toolip pre-commit
+```
+
+Inspect packages:
+
+```bash
+toolip inspect express
+
+toolip compare axios got
+
+toolip alternatives request
+```
+
+Manage secrets:
+
+```bash
+toolip vault init
+
+toolip vault set DATABASE_URL
+
+toolip vault get DATABASE_URL
+```
+
+---
+
+# Features
+
+---
+
+## Project Fingerprinting
+
+```bash
+toolip profile
+```
+
+Detects technologies used within a project.
+
+Examples:
+
+* Node.js
+* TypeScript
+* Fastify
+* Express
+* React
+* PostgreSQL
+* MongoDB
+* Redis
+
+Provides technology-aware recommendations.
+
+---
+
+## Dependency Scanning
+
+```bash
+toolip scan
+```
+
+Analyzes project dependencies.
+
+Detects:
+
+* Deprecated packages
+* Outdated packages
+* High-risk packages
+* Dependency bloat
+* Supply chain concerns
+
+Provides actionable recommendations.
+
+---
+
+## Package Inspection
+
+```bash
+toolip inspect express
+```
+
+Displays:
+
+* Latest version
+* Maintainer information
+* Deprecation status
+* Package metadata
+* Risk score
+
+Useful when evaluating new dependencies.
+
+---
+
+## Package Comparison
+
+```bash
+toolip compare axios got
+```
+
+Compare multiple packages based on:
+
+* Dependency count
+* Risk indicators
+* Maintenance activity
+* General package health
+
+Useful when choosing between alternatives.
+
+---
+
+## Package Alternatives
+
+```bash
+toolip alternatives request
+```
+
+Suggests safer or more modern replacements for packages that are:
+
+* Deprecated
+* Legacy
+* Poorly maintained
+
+---
+
+## Dependency Tree Analysis
+
+```bash
+toolip tree
+```
+
+Provides visibility into dependency structure.
+
+Displays:
+
+* Dependency hierarchy
+* Dependency depth
+* Transitive relationships
+
+Useful when investigating package risk.
+
+---
+
+## License Analysis
+
+```bash
+toolip licenses
+```
+
+Analyzes project licensing.
+
+Provides:
+
+* License inventory
+* License distribution
+* Restrictive license warnings
+
+---
+
+# Security Doctor
+
+```bash
+toolip doctor
+```
+
+Runs a comprehensive project security audit.
+
+Checks for:
+
+### Secret Exposure
+
+Detects:
+
+* GitHub tokens
+* API keys
+* JWT secrets
+* AWS credentials
+* Private keys
+* Hardcoded passwords
+
+### Dangerous Code Patterns
+
+Detects:
+
+* eval()
+* Function constructor usage
+* Unsafe shell execution
+* Dangerous runtime patterns
+
+### Configuration Risks
+
+Checks for:
+
+* Open CORS policies
+* Insecure configuration patterns
+* Weak environment practices
+
+### Security Headers
+
+Identifies missing:
+
+* Content-Security-Policy
+* X-Frame-Options
+* X-Content-Type-Options
+* Strict-Transport-Security
+
+---
+
+# Git Security
+
+---
+
+## Git Audit
+
+```bash
+toolip git-audit
+```
+
+Analyzes Git hygiene.
+
+Checks for:
+
+* Sensitive files
+* Weak ignore rules
+* Dangerous artifacts
+* Common security mistakes
+
+---
+
+## Pre-Commit Checks
+
+```bash
+toolip pre-commit
+```
+
+Runs blocking security checks before commits.
+
+Detects:
+
+* Secrets
+* Credentials
+* Security violations
+* Dangerous files
+
+Designed to stop mistakes before they reach Git history.
+
+---
+
+## Git Hook Installation
+
+```bash
+toolip hook install
+```
+
+Installs Toolip-powered Git hooks.
+
+Allows security checks to run automatically before commits.
+
+---
+
+# Security Scorecards
+
+```bash
+toolip score
+```
+
+Calculates a security score based on:
+
+* Dependency Health
+* Secret Hygiene
+* Configuration Security
+* Git Safety
+
+Example:
+
+```text
+Dependency Health .... 91
+Secret Hygiene ....... 84
+Configuration ........ 88
+Git Safety ........... 95
+
+Overall Score ........ 89
+Grade ................ A
+```
+
+---
+
+# Learning Mode
+
+One of Toolip's signature features.
+
+```bash
+toolip learn cors
+```
+
+Toolip teaches while it scans.
+
+Available topics include:
+
+* CORS
+* JWT
+* XSS
+* CSRF
+* Authentication
+* Authorization
+* Secrets Management
+* Dependency Security
+
+Each lesson includes:
+
+* Explanation
+* Risks
+* Common mistakes
+* Secure examples
+* Best practices
+
+Designed for developers learning secure software engineering.
+
+---
+
+# Toolip Vault
+
+Toolip includes a lightweight encrypted local secrets manager.
+
+---
+
+## Initialize Vault
+
+```bash
+toolip vault init
+```
+
+Creates an encrypted local vault.
+
+---
+
+## Store Secrets
+
+```bash
+toolip vault set DATABASE_URL
+```
+
+Stores secrets securely.
+
+---
+
+## Retrieve Secrets
+
+```bash
+toolip vault get DATABASE_URL
+```
+
+Returns decrypted values after authentication.
+
+---
+
+## List Secrets
+
+```bash
+toolip vault list
+```
+
+Displays secret names without revealing values.
+
+---
+
+## Delete Secrets
+
+```bash
+toolip vault delete DATABASE_URL
+```
+
+Removes stored secrets.
+
+---
+
+## Export Environment Variables
+
+```bash
+toolip vault export --env development
+```
+
+Supports:
+
+* development
+* staging
+* production
+
+---
+
+## Vault Security Features
+
+* AES-256 Encryption
+* Password Protection
+* Local Storage Only
+* Offline Operation
+
+No cloud storage.
+
+No synchronization.
+
+No accounts.
+
+No remote services.
+
+---
+
+# Command Reference
+
+| Command             | Description                        |
+| ------------------- | ---------------------------------- |
+| toolip profile      | Fingerprint project technologies   |
+| toolip scan         | Analyze dependencies               |
+| toolip doctor       | Perform security audit             |
+| toolip score        | Generate security scorecard        |
+| toolip inspect      | Inspect package metadata           |
+| toolip compare      | Compare packages                   |
+| toolip alternatives | Suggest replacements               |
+| toolip licenses     | Analyze licenses                   |
+| toolip tree         | Analyze dependency hierarchy       |
+| toolip git-audit    | Audit Git hygiene                  |
+| toolip pre-commit   | Run pre-commit security checks     |
+| toolip hook install | Install Git hooks                  |
+| toolip learn        | Security education mode            |
+| toolip vault        | Encrypted local secrets management |
+
+---
+
+# Design Principles
+
+Toolip follows several guiding principles:
+
+* Developer First
+* CLI First
+* Security Education
+* Local Development Friendly
+* CI/CD Friendly
+* Framework Agnostic
+* Actionable Guidance
+* Secure by Default
+
+---
+
+# Technology Stack
+
+Built with:
+
+* TypeScript
+* Node.js
+* Commander.js
+* Vitest
+* Chalk
+* Ora
+* Zod
+* npm Registry APIs
+* Git Integration
+* Node Crypto APIs
+
+---
+
+# Use Cases
+
+Toolip is useful for:
+
+* Backend Engineers
+* Platform Engineers
+* DevOps Engineers
+* Open Source Maintainers
+* Startup Teams
+* Full Stack Developers
+* Students Learning Security
+
+---
+
+# Portfolio Positioning
+
+Toolip demonstrates experience with:
+
+* TypeScript Engineering
+* CLI Development
+* Security Engineering Concepts
+* Supply Chain Security
+* Secret Management
+* Static Analysis
+* Git Integration
+* Risk Scoring Systems
+* Developer Experience Design
+* Secure Development Workflows
+
+---
+
+# Author
+
+**Ashibuogwu Williams (wbizmo)**
+
+GitHub: https://github.com/wbizmo
+
+---
+
+# License
+
+MIT License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolip",
-  "version": "1.0.3",
+  "version": "1.0.6",
   "description": "Developer-first supply chain security, security hygiene, and secrets management CLI.",
   "type": "module",
   "bin": {

package/dist/src/commands/alternatives.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from 'commander';
-export declare function registerAlternativesCommand(program: Command): void;

package/dist/src/commands/alternatives.js

@@ -1,17 +0,0 @@
-import chalk from 'chalk';
-import { findAlternatives } from '../core/alternatives.js';
-export function registerAlternativesCommand(program) {
-    program
-        .command('alternatives <package>')
-        .description('Suggest safer or better-maintained package alternatives.')
-        .action((packageName) => {
-        const result = findAlternatives(packageName);
-        console.log(chalk.bold(`Alternatives for ${result.package}`));
-        console.log('');
-        for (const alternative of result.alternatives) {
-            console.log(`${chalk.green('✓')} ${chalk.bold(alternative.name)}`);
-            console.log(`  ${alternative.reason}`);
-        }
-    });
-}
-//# sourceMappingURL=alternatives.js.map

package/dist/src/commands/alternatives.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"alternatives.js","sourceRoot":"","sources":["../../../src/commands/alternatives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,OAAO;SACJ,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,CAAC,WAAmB,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/compare.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from 'commander';
-export declare function registerCompareCommand(program: Command): void;

package/dist/src/commands/compare.js

@@ -1,19 +0,0 @@
-import { comparePackages } from '../core/compare-packages.js';
-import { printPackageComparison } from '../utils/package-output.js';
-import { ToolipError } from '../errors/toolip-error.js';
-export function registerCompareCommand(program) {
-    program
-        .command('compare <packages...>')
-        .description('Compare npm packages by maintenance and risk signals.')
-        .action(async (packageNames) => {
-        if (packageNames.length < 2) {
-            throw new ToolipError('Please provide at least two packages to compare.', {
-                code: 'COMPARE_REQUIRES_TWO_PACKAGES',
-                exitCode: 1
-            });
-        }
-        const comparison = await comparePackages(packageNames);
-        printPackageComparison(comparison);
-    });
-}
-//# sourceMappingURL=compare.js.map

package/dist/src/commands/compare.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../../src/commands/compare.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,YAAsB,EAAE,EAAE;QACvC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,kDAAkD,EAAE;gBACxE,IAAI,EAAE,+BAA+B;gBACrC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;QACvD,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/doctor.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from 'commander';
-export declare function registerDoctorCommand(program: Command): void;

package/dist/src/commands/doctor.js

@@ -1,42 +0,0 @@
-import chalk from 'chalk';
-import { createScannerContext } from '../core/scanner-context.js';
-import { createReport } from '../core/report.js';
-import { writeReport } from '../core/report-writer.js';
-import { runSecurityDoctor } from '../core/security-doctor.js';
-import { TOOLIP_VERSION } from '../config/version.js';
-import { printReportSummary, printScannerContext } from '../utils/output.js';
-export function registerDoctorCommand(program) {
-    program
-        .command('doctor')
-        .description('Run a full project security hygiene audit.')
-        .option('-p, --path <path>', 'Project path to audit.', process.cwd())
-        .option('-o, --output <file>', 'Write doctor report to JSON or Markdown.')
-        .action(async (options) => {
-        console.log(chalk.bold('Toolip Doctor'));
-        console.log('');
-        const context = await createScannerContext(options.path);
-        printScannerContext(context);
-        const doctor = await runSecurityDoctor(context.root);
-        const report = createReport({
-            version: TOOLIP_VERSION,
-            command: 'doctor',
-            root: context.root,
-            findings: doctor.findings
-        });
-        console.log('');
-        console.log(chalk.bold('Security Hygiene'));
-        console.log(`${chalk.dim('Files Scanned:')} ${doctor.summary.filesScanned}`);
-        console.log(`${chalk.dim('Secrets:')} ${doctor.summary.secrets}`);
-        console.log(`${chalk.dim('Dangerous Code:')} ${doctor.summary.dangerousCode}`);
-        console.log(`${chalk.dim('Configuration:')} ${doctor.summary.configuration}`);
-        console.log(`${chalk.dim('Security Headers:')} ${doctor.summary.headers}`);
-        console.log('');
-        printReportSummary(report);
-        if (options.output) {
-            await writeReport(options.output, report);
-            console.log('');
-            console.log(`${chalk.green('✓')} Report written to ${options.output}`);
-        }
-    });
-}
-//# sourceMappingURL=doctor.js.map

package/dist/src/commands/doctor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SACpE,MAAM,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAA0C,EAAE,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,YAAY,CAAC;YAC1B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/git-audit.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from 'commander';
-export declare function registerGitAuditCommand(program: Command): void;