vaspera 2.5.0

package/CHANGELOG.md

@@ -0,0 +1,184 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.5.0] - 2026-04-24
+
+### Added
+
+#### Mythos-Class Security Scanners
+- New `binary-analysis` scanner for native module security
+  - Detects Node.js native addons, shared libraries, Rust FFI, Go CGO
+  - Checks RELRO, NX, PIE, CANARY protections via checksec
+  - Scans for dangerous imports and hardcoded paths
+- New `memory-safety` scanner for memory corruption vulnerabilities
+  - Integrates with cppcheck for C/C++ analysis
+  - Detects buffer overflows (CWE-120, CWE-787)
+  - Detects use-after-free (CWE-416) and double-free (CWE-415)
+  - Pattern-based detection for dangerous C functions (strcpy, sprintf, gets)
+  - Rust unsafe code detection via cargo-geiger
+- New `race-condition` scanner for concurrency bugs
+  - Go: goroutine data race detection via go vet
+  - Node.js: async/await shared state patterns
+  - Python: threading and multiprocessing issues
+  - Java: check-then-act and synchronized patterns
+
+#### Semantic AI Agents
+- New `zero-day-hunter` agent for novel vulnerability discovery
+  - AI-powered semantic code analysis beyond pattern matching
+  - Discovers logic flaws, auth bypasses, cryptographic weaknesses
+  - Confidence scoring with evidence extraction
+  - CWE mapping for compliance alignment
+- New `logic-flaw-detector` agent for business logic bugs
+  - Detects state inconsistencies and race conditions
+  - Identifies boundary condition issues and error handling gaps
+  - Analyzes trust boundaries and client-side data usage
+- New `exploit-chain` analyzer for attack path mapping
+  - Automatically chains multiple vulnerabilities into attack paths
+  - Maps SSRF → internal API, XSS → session hijacking paths
+  - MITRE ATT&CK technique mapping for each chain
+  - Severity escalation calculation (medium + medium = critical)
+
+#### New MCP Tools
+- `certification_scan_binary` - Scan compiled code and native modules
+- `certification_analyze_chains` - Analyze findings for exploitable chains
+- `certification_semantic_analysis` - Run AI-powered semantic analysis
+
+#### Compliance Enhancements
+- Added MITRE ATT&CK technique mapping for AI/ML systems
+- New CWE mappings for memory safety vulnerabilities
+- New CWE mappings for race condition vulnerabilities
+- OWASP LLM Top 10 integration
+
+### Changed
+- Updated scanner count from 9 to 13+ scanners
+- Updated agent count from 4 to 7+ agents
+- Updated frontend marketing pages with Mythos-class capabilities
+- Demo page now reflects new scanner and agent counts
+
+## [2.0.0] - 2024-01-15
+
+### Added
+
+#### Cost Tracking
+- New `cost_track` tool to start tracking costs for a certification
+- New `cost_estimate` tool to estimate costs before running
+- New `cost_status` tool to get current cost status
+- New `cost_report` tool to generate detailed cost reports
+- New `cost_budget` tool to set/update budget limits
+- New `cost_models` tool to list supported models and pricing
+- Support for 13 LLM models: Claude (4), GPT (5), Gemini (3), O1 (3)
+- Budget limits with automatic warnings and abort capability
+
+#### Multi-Model Consensus
+- New `multimodel_record` tool to record findings from model runs
+- New `multimodel_consensus` tool to calculate inter-model agreement
+- New `multimodel_disagreements` tool to identify model disagreements
+- New `multimodel_merged` tool to get deduplicated findings
+- New `multimodel_summary` tool to generate multi-model summaries
+- New `multimodel_models` tool to list/configure available models
+- New `multimodel_clear` tool to clear results
+- Fleiss' kappa calculation for inter-rater reliability
+- Finding similarity matching across models
+- Disagreement detection by type (existence, severity, location, description)
+
+#### Compliance Mapping
+- New `compliance_report` tool for single-framework reports
+- New `compliance_multi_report` tool for multi-framework reports
+- New `compliance_controls` tool to list framework controls
+- SOC 2 Type II mapping (17 controls)
+- ISO 27001 Annex A mapping (14 categories)
+- Control status assessment (Compliant/At-Risk/Non-Compliant)
+- Finding-to-control mapping by category
+
+#### SBOM & Provenance
+- New `sbom_generate` tool for CycloneDX SBOM generation
+- New `sbom_provenance` tool for SLSA provenance attestation
+- New `sbom_sign` tool for Sigstore signing
+- New `sbom_verify_provenance` tool for provenance verification
+- Dependency inventory generation
+- Build attestation with SLSA Level 2 support
+
+#### Documentation
+- New `docs/` folder with feature documentation
+- Cost tracking guide (`docs/cost-tracking.md`)
+- Multi-model consensus guide (`docs/multi-model.md`)
+- Compliance mapping guide (`docs/compliance.md`)
+- Complete MCP tools reference (`docs/mcp-tools.md`)
+- Example workflows (`docs/examples/`)
+
+### Changed
+- Updated MCP tool count from 36 to 52
+- Updated package description to highlight enterprise features
+- README now includes v2.0.0 features section
+
+### Fixed
+- Finding type now uses `description` consistently (removed legacy `title`)
+- Multi-model consensus correctly handles partial model agreement
+- Cost calculation uses accurate per-model pricing
+
+## [1.1.0] - 2024-01-01
+
+### Added
+
+#### Deterministic Scanners
+- Semgrep integration for OWASP Top 10
+- gitleaks integration for secrets detection
+- npm audit integration for CVE detection
+- TypeScript analysis for type safety
+
+#### GitHub Action
+- `action.yml` for CI/CD integration
+- Diff-mode scanning for PRs
+- PR comment formatting
+- SARIF upload to GitHub Code Scanning
+
+#### Evaluation Harness
+- Test fixtures for scanner accuracy
+- Precision, recall, F1 metrics
+- Stability testing across runs
+- Target thresholds for publication
+
+#### Custom Rules
+- `rules_load` for custom rule loading
+- `rules_templates` for built-in templates
+- `rules_generate_config` for config generation
+- `rules_check_file` for file checking
+
+### Changed
+- Scanner findings now have confidence: 100
+- LLM agents reference scanner findings by ID
+
+## [1.0.2] - 2023-12-15
+
+### Added
+- Cross-verification system between agents
+- Consensus scoring with certification levels
+- SARIF export for GitHub integration
+
+### Fixed
+- Evidence validation for LLM findings
+- Finding deduplication logic
+
+## [1.0.1] - 2023-12-01
+
+### Added
+- File hash-based caching
+- Agent finding submission tools
+- Basic certification workflow
+
+### Fixed
+- Project discovery on macOS
+- Command installation paths
+
+## [1.0.0] - 2023-11-15
+
+### Added
+- Initial release
+- 6 certification agents (security, reliability, typesafety, performance, quality, redteam)
+- Hardening command installation
+- Portfolio dashboard
+- AUDIT.md and HARDENING-REPORT.md generation

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Ryan Colkitt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.