SafeAI-Static-Analyzer 1.9.1__tar.gz → 2.0.0__tar.gz

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 1.9.1
+Version: 2.0.0
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -37,6 +37,8 @@ Dynamic: license-file
 [![Latest Release](https://img.shields.io/badge/latest-v1.9.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v1.9.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
+Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
+
 **SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
@@ -80,7 +82,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 15 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 16 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -116,7 +118,7 @@ File Collection — Python, YAML, JSON, .prompt, and .claude configs;
                  prunes VCS, caches, oversized files, and SafeAI's own artifacts
     │
     ▼
-Framework Detection — 15 parsers (AST + config + regex), all run on all files;
+Framework Detection — 16 parsers (AST + config + regex), all run on all files;
                      import graph and dependency manifests
     │
     ▼
@@ -165,13 +167,14 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | LlamaIndex | ✔ | Partial | Minimal | Minimal | Experimental |
 | Dify | ✔ | Minimal | Minimal | Minimal | Experimental |
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
+| Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
 
 - **LangGraph** — detects `StateGraph`, `add_edge`, `bind_tools`, nodes, models
 - **CrewAI** — detects `Agent`, `Task`, tools, models
-- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, agent delegation
+- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, `register_function`, models
 - **LangChain** — detects `AgentExecutor`, `Chain`, `Tool`, `PromptTemplate`, models
 - **Semantic Kernel** — detects `Kernel.invoke`, plugins, functions, skills, memory
 - **OpenAI Agents SDK** — detects `Agent`, tools, handoffs, MCP references
@@ -186,6 +189,9 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **LlamaIndex** — detects agents, tools, indexes, and model references
 - **Dify** — detects Dify workflow and agent configuration files
 - **n8n** — detects n8n workflow exports, nodes, and connections
+- **Cursor (.cursorrules)** — detects declared tools/permissions and
+  capability-relevant keywords (shell, filesystem, HTTP, database) in the
+  IDE's rules config, JSON, YAML, or free text
 
 Maturity is on the scale defined in [`FRAMEWORK_SUPPORT.md`](FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -761,10 +767,19 @@ See [ROADMAP.md](./ROADMAP.md) for the detailed roadmap.
 SafeAI is built by and for the AI security community. Thank you to all
 contributors who have helped make AI safer:
 
-- **[@Aming9303](https://github.com/Aming9303)** — `safeai registry components`
-  CLI ([#82](https://github.com/ikaruscareer/SafeAI/pull/82)),
-  `safeai init` command ([#83](https://github.com/ikaruscareer/SafeAI/pull/83)),
-  GitHub Actions workflow example ([#84](https://github.com/ikaruscareer/SafeAI/pull/84)).
+| Contributor | Key Contributions |
+|-------------|-------------------|
+| [@i-safonoff](https://github.com/i-safonoff) | `.cursorrules` framework adapter, `rule_coverage_summary()`, RULES_REFERENCE.md, dataflow casing fix |
+| [@ARAVIND281](https://github.com/ARAVIND281) | Claude Code permission evaluation order, interprocedural data-flow tracking |
+| [@Solarthis](https://github.com/Solarthis) | MCP tool description injection detection |
+| [@Aming9303](https://github.com/Aming9303) | `safeai registry components` CLI, `safeai init` command, GitHub Actions example |
+| [@adnqcr7-code](https://github.com/adnqcr7-code) | Framework detection tests (LangGraph, CrewAI, LlamaIndex, n8n, Claude Code), CI/SARIF docs |
+| [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
+| [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
+| [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
+| [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
+| [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to get involved.
 

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/README.md

@@ -6,6 +6,8 @@
 [![Latest Release](https://img.shields.io/badge/latest-v1.9.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v1.9.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
+Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
+
 **SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
@@ -49,7 +51,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 15 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 16 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -85,7 +87,7 @@ File Collection — Python, YAML, JSON, .prompt, and .claude configs;
                  prunes VCS, caches, oversized files, and SafeAI's own artifacts
     │
     ▼
-Framework Detection — 15 parsers (AST + config + regex), all run on all files;
+Framework Detection — 16 parsers (AST + config + regex), all run on all files;
                      import graph and dependency manifests
     │
     ▼
@@ -134,13 +136,14 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | LlamaIndex | ✔ | Partial | Minimal | Minimal | Experimental |
 | Dify | ✔ | Minimal | Minimal | Minimal | Experimental |
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
+| Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
 
 - **LangGraph** — detects `StateGraph`, `add_edge`, `bind_tools`, nodes, models
 - **CrewAI** — detects `Agent`, `Task`, tools, models
-- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, agent delegation
+- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, `register_function`, models
 - **LangChain** — detects `AgentExecutor`, `Chain`, `Tool`, `PromptTemplate`, models
 - **Semantic Kernel** — detects `Kernel.invoke`, plugins, functions, skills, memory
 - **OpenAI Agents SDK** — detects `Agent`, tools, handoffs, MCP references
@@ -155,6 +158,9 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **LlamaIndex** — detects agents, tools, indexes, and model references
 - **Dify** — detects Dify workflow and agent configuration files
 - **n8n** — detects n8n workflow exports, nodes, and connections
+- **Cursor (.cursorrules)** — detects declared tools/permissions and
+  capability-relevant keywords (shell, filesystem, HTTP, database) in the
+  IDE's rules config, JSON, YAML, or free text
 
 Maturity is on the scale defined in [`FRAMEWORK_SUPPORT.md`](FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -730,10 +736,19 @@ See [ROADMAP.md](./ROADMAP.md) for the detailed roadmap.
 SafeAI is built by and for the AI security community. Thank you to all
 contributors who have helped make AI safer:
 
-- **[@Aming9303](https://github.com/Aming9303)** — `safeai registry components`
-  CLI ([#82](https://github.com/ikaruscareer/SafeAI/pull/82)),
-  `safeai init` command ([#83](https://github.com/ikaruscareer/SafeAI/pull/83)),
-  GitHub Actions workflow example ([#84](https://github.com/ikaruscareer/SafeAI/pull/84)).
+| Contributor | Key Contributions |
+|-------------|-------------------|
+| [@i-safonoff](https://github.com/i-safonoff) | `.cursorrules` framework adapter, `rule_coverage_summary()`, RULES_REFERENCE.md, dataflow casing fix |
+| [@ARAVIND281](https://github.com/ARAVIND281) | Claude Code permission evaluation order, interprocedural data-flow tracking |
+| [@Solarthis](https://github.com/Solarthis) | MCP tool description injection detection |
+| [@Aming9303](https://github.com/Aming9303) | `safeai registry components` CLI, `safeai init` command, GitHub Actions example |
+| [@adnqcr7-code](https://github.com/adnqcr7-code) | Framework detection tests (LangGraph, CrewAI, LlamaIndex, n8n, Claude Code), CI/SARIF docs |
+| [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
+| [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
+| [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
+| [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
+| [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to get involved.
 

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/SafeAI_Static_Analyzer.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: SafeAI-Static-Analyzer
-Version: 1.9.1
+Version: 2.0.0
 Summary: The lightweight, open-source Static AI Capability & Risk Analyzer for CI/CD pipelines.
 Author: IkarusCareer
 License-Expression: Apache-2.0
@@ -37,6 +37,8 @@ Dynamic: license-file
 [![Latest Release](https://img.shields.io/badge/latest-v1.9.0-0f766e)](https://github.com/ikaruscareer/SafeAI/releases/tag/v1.9.0)
 [![Best Practices](https://bestpractices.dev/projects/14126/badge)](https://www.bestpractices.dev/en/projects/14126)
 
+Enjoying SafeAI? A ⭐ on [GitHub](https://github.com/ikaruscareer/SafeAI) helps more security teams find it.
+
 **SafeAI** is a static analysis tool that scans AI application source code for security risks, capability exposure, and governance gaps. It runs entirely offline, never executes agents or calls LLMs, and integrates into CI/CD pipelines.
 
 > 🌐 [safeai-analyzer.ikaruscareer.com](https://safeai-analyzer.ikaruscareer.com) — project landing page
@@ -80,7 +82,7 @@ SafeAI sits before runtime guardrails and red-teaming tools in the security life
 
 | Feature | Description |
 |---------|-------------|
-| **Framework Detection** | Detects and parses 15 AI agent frameworks (AST + config + regex, no mutual exclusion) |
+| **Framework Detection** | Detects and parses 16 AI agent frameworks (AST + config + regex, no mutual exclusion) |
 | **Tool Identity & Access Modes** | Capabilities attributed to named tools (agent / MCP server / skill / tool / workflow node) on an access scale `none < read < write < mutate < execute`; inferred modes are flagged, never overstated |
 | **Capability Discovery** | Maps 19 capability categories (shell, filesystem, network, database, memory, MCP, ...) with evidence, confidence, and provenance |
 | **Capability Escalation Detection** | Per-tool authority diffs between scans (new shell, read→write widening, new MCP server, removed approval gate, ...) — 14 rules, including gating-aware subsumption |
@@ -116,7 +118,7 @@ File Collection — Python, YAML, JSON, .prompt, and .claude configs;
                  prunes VCS, caches, oversized files, and SafeAI's own artifacts
     │
     ▼
-Framework Detection — 15 parsers (AST + config + regex), all run on all files;
+Framework Detection — 16 parsers (AST + config + regex), all run on all files;
                      import graph and dependency manifests
     │
     ▼
@@ -165,13 +167,14 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 | LlamaIndex | ✔ | Partial | Minimal | Minimal | Experimental |
 | Dify | ✔ | Minimal | Minimal | Minimal | Experimental |
 | n8n | ✔ | Partial | Minimal | Minimal | Experimental |
+| Cursor (.cursorrules) | ✔ | Minimal | Minimal | Minimal | Experimental |
 
 
 ### Framework Support Details
 
 - **LangGraph** — detects `StateGraph`, `add_edge`, `bind_tools`, nodes, models
 - **CrewAI** — detects `Agent`, `Task`, tools, models
-- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, agent delegation
+- **AutoGen** — detects `AssistantAgent`, `UserProxyAgent`, `register_for_llm`, `register_function`, models
 - **LangChain** — detects `AgentExecutor`, `Chain`, `Tool`, `PromptTemplate`, models
 - **Semantic Kernel** — detects `Kernel.invoke`, plugins, functions, skills, memory
 - **OpenAI Agents SDK** — detects `Agent`, tools, handoffs, MCP references
@@ -186,6 +189,9 @@ Registry & Reports — shared SQLite registry; terminal, JSON, SARIF 2.1.0, HTML
 - **LlamaIndex** — detects agents, tools, indexes, and model references
 - **Dify** — detects Dify workflow and agent configuration files
 - **n8n** — detects n8n workflow exports, nodes, and connections
+- **Cursor (.cursorrules)** — detects declared tools/permissions and
+  capability-relevant keywords (shell, filesystem, HTTP, database) in the
+  IDE's rules config, JSON, YAML, or free text
 
 Maturity is on the scale defined in [`FRAMEWORK_SUPPORT.md`](FRAMEWORK_SUPPORT.md):
 **Partial** = reliable detection and discovery with capability/risk analysis over
@@ -761,10 +767,19 @@ See [ROADMAP.md](./ROADMAP.md) for the detailed roadmap.
 SafeAI is built by and for the AI security community. Thank you to all
 contributors who have helped make AI safer:
 
-- **[@Aming9303](https://github.com/Aming9303)** — `safeai registry components`
-  CLI ([#82](https://github.com/ikaruscareer/SafeAI/pull/82)),
-  `safeai init` command ([#83](https://github.com/ikaruscareer/SafeAI/pull/83)),
-  GitHub Actions workflow example ([#84](https://github.com/ikaruscareer/SafeAI/pull/84)).
+| Contributor | Key Contributions |
+|-------------|-------------------|
+| [@i-safonoff](https://github.com/i-safonoff) | `.cursorrules` framework adapter, `rule_coverage_summary()`, RULES_REFERENCE.md, dataflow casing fix |
+| [@ARAVIND281](https://github.com/ARAVIND281) | Claude Code permission evaluation order, interprocedural data-flow tracking |
+| [@Solarthis](https://github.com/Solarthis) | MCP tool description injection detection |
+| [@Aming9303](https://github.com/Aming9303) | `safeai registry components` CLI, `safeai init` command, GitHub Actions example |
+| [@adnqcr7-code](https://github.com/adnqcr7-code) | Framework detection tests (LangGraph, CrewAI, LlamaIndex, n8n, Claude Code), CI/SARIF docs |
+| [@hadbiaghiles](https://github.com/hadbiaghiles) | AutoGen framework documentation |
+| [@D05TL3](https://github.com/D05TL3) | GitHub Actions scanning example |
+| [@mikemikimike](https://github.com/mikemikimike) | Adapter negative detection tests |
+| [@mah](https://github.com/mahirhir) | Claude Code deep analysis documentation |
+| [@asarakhatun17-lgtm](https://github.com/asarakhatun17-lgtm) | Supported frameworks consistency fix |
+| [@yugaaank](https://github.com/yugaaank) | Capability detectors (Docker, Kubernetes, Redis, S3, GCP, Slack, Jira, browser) |
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to get involved.
 

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/SafeAI_Static_Analyzer.egg-info/SOURCES.txt

@@ -81,6 +81,8 @@ safeai/frameworks/claude_code/permissions.py
 safeai/frameworks/claude_code/settings.py
 safeai/frameworks/crewai/__init__.py
 safeai/frameworks/crewai/parser.py
+safeai/frameworks/cursorrules/__init__.py
+safeai/frameworks/cursorrules/parser.py
 safeai/frameworks/dify/__init__.py
 safeai/frameworks/dify/parser.py
 safeai/frameworks/google_adk/__init__.py
@@ -103,6 +105,8 @@ safeai/frameworks/openai_agents/__init__.py
 safeai/frameworks/openai_agents/parser.py
 safeai/frameworks/semantic_kernel/__init__.py
 safeai/frameworks/semantic_kernel/parser.py
+safeai/frameworks/windsurf/__init__.py
+safeai/frameworks/windsurf/parser.py
 safeai/kya/__init__.py
 safeai/kya/assurance.py
 safeai/kya/baseline.py
@@ -121,6 +125,7 @@ safeai/kya/registry/persist.py
 safeai/kya/registry/queries.py
 safeai/kya/registry/schema.py
 safeai/report/__init__.py
+safeai/report/failure_matrix.py
 safeai/report/html.py
 safeai/report/html_kit.py
 safeai/report/json_report.py
@@ -149,8 +154,10 @@ tests/test_component_hash.py
 tests/test_confidence_arbitration.py
 tests/test_control_mappings.py
 tests/test_crewai_framework.py
+tests/test_cursorrules_framework.py
 tests/test_env_dependency.py
 tests/test_escalation.py
+tests/test_evidence_type.py
 tests/test_fingerprints.py
 tests/test_github_action.py
 tests/test_governance_analyzer.py
@@ -160,6 +167,7 @@ tests/test_kya_integration.py
 tests/test_kya_manifest.py
 tests/test_langgraph_framework.py
 tests/test_llamaindex_framework.py
+tests/test_mcp_tool_poisoning.py
 tests/test_mcp_validation.py
 tests/test_n8n_workflow.py
 tests/test_parser_aggregation.py
@@ -184,4 +192,5 @@ tests/test_target_taxonomy_engine.py
 tests/test_telemetry.py
 tests/test_tool_identity.py
 tests/test_tool_implementation.py
-tests/test_version.py
+tests/test_version.py
+tests/test_windsurf_framework.py

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/safeai/analyzers/capability/analyzer.py

@@ -72,6 +72,7 @@ CATEGORY_BY_CAP = {
 def _finding(rule_id, rule, message, path, line, capability, framework="generic", evidence=None, confidence=0.6, score_contribution=8):
     return {
         "rule_id": rule_id,
+        "evidence_type": "static-pattern",  # #94 - regex fallback pass over raw file content
         "severity": rule.get("severity", "medium"),
         "message": message,
         "file": path,
@@ -160,6 +161,7 @@ class CapabilityAnalyzer:
 
             findings.append({
                 "rule_id": rule_id,
+                "evidence_type": "static-pattern",  # #94 - regex fallback pass over raw file content
                 "severity": rule.get("severity", "medium"),
                 "message": f"Capability discovered: {cap_name}",
                 "file": path,
@@ -249,6 +251,7 @@ class CapabilityAnalyzer:
                         rule = rule_map.get("CAP_AUTONOMY", {})
                         findings.append({
                             "rule_id": "CAP_AUTONOMY",
+                            "evidence_type": "static-pattern",  # #94 - regex fallback pass over raw file content
                             "severity": rule.get("severity", "high"),
                             "message": "Potential autonomous agent loop detected",
                             "file": path,

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/safeai/analyzers/claude_code/analyzer.py

@@ -22,8 +22,9 @@ _REMEDIATION = {
                               "command or path pattern the workflow needs.",
     "CC_BYPASS_PERMISSIONS": "Remove the bypass/auto-approve setting and keep the "
                              "human approval gate enabled in committed settings.",
-    "CC_DENY_SHADOWED": "Narrow the allow entry so the deny entry can take effect, "
-                        "or remove the deny entry that cannot apply.",
+    "CC_DENY_SHADOWED": "Remove the allow entry that cannot apply, or narrow the "
+                        "deny entry if the allow was the intended behaviour. The "
+                        "deny is what takes effect.",
     "CC_FS_WRITE_OUTSIDE_ROOT": "Constrain write grants to paths inside the project root.",
     "CC_SLASH_COMMAND_SHELL": "Pin the command, avoid inline shell in stored "
                               "instructions, and review who can invoke it.",
@@ -98,6 +99,7 @@ def _finding(rule_id, rule_map, message, path, line, evidence, reason, severity=
     resolved = severity or rule.get("severity") or _DEFAULT_SEVERITY.get(rule_id, "medium")
     return {
         "rule_id": rule_id,
+        "evidence_type": "static-config",  # #94 - reads declared permission/hook/settings entries
         "severity": resolved,
         "message": message,
         "file": path,
@@ -204,15 +206,27 @@ class ClaudeCodeAnalyzer:
 
     def _permission_findings(self, records, rule_map):
         findings = []
+        effective = cc_permissions.resolve_effective_rules(records)
         for record in records:
             if record["decision"] == "allow" and record["wildcard"] and record["tool"]:
+                # #93 - a wildcard allow grants nothing the tool's denies do not
+                # already take back, at any scope. Report it, but not as though
+                # the surface were unbounded when it demonstrably is not.
+                constrained = effective.get(str(record["tool"]).lower(), {}).get("decision") == "deny"
                 findings.append(_finding(
                     "CC_WILDCARD_PERMISSION", rule_map,
                     f"Unconstrained Claude Code permission: {record['entry']}",
                     record["path"], record["line"],
                     evidence=record["entry"],
-                    reason=f"{record['tool']} is allowed with no argument constraint, granting "
-                           f"{record['access_mode']} authority over its entire surface.",
+                    reason=(
+                        f"{record['tool']} is allowed with no argument constraint, but a deny "
+                        f"rule for the same tool is evaluated first, so the granted surface is "
+                        f"bounded by that deny."
+                        if constrained else
+                        f"{record['tool']} is allowed with no argument constraint, granting "
+                        f"{record['access_mode']} authority over its entire surface."
+                    ),
+                    severity="medium" if constrained else None,
                 ))
             if cc_permissions.writes_outside_root(record):
                 findings.append(_finding(
@@ -225,14 +239,21 @@ class ClaudeCodeAnalyzer:
                     capability="Filesystem",
                 ))
 
-        for deny, allow in cc_permissions.shadowed_denials(records):
+        # #93 - this finding used to be stated the wrong way round. Claude Code
+        # evaluates deny, then ask, then allow, and "rule specificity doesn't
+        # change the order", so a matching deny ALWAYS decides the call. It is
+        # the allow that is dead configuration, not the deny, and the severity
+        # follows: contradictory rules are a maintenance problem, not a hole.
+        for allow, deny in cc_permissions.ineffective_allows(records):
             findings.append(_finding(
                 "CC_DENY_SHADOWED", rule_map,
-                f"Deny entry is shadowed by a broader allow: {deny['entry']}",
-                deny["path"], deny["line"],
-                evidence=f"deny {deny['entry']} vs allow {allow['entry']}",
-                reason="The deny entry cannot take effect because a broader allow entry covers "
-                       "it, so the configuration reads as safer than it behaves.",
+                f"Allow entry can never apply, a deny covers it: {allow['entry']}",
+                allow["path"], allow["line"],
+                evidence=f"allow {allow['entry']} overridden by deny {deny['entry']}",
+                reason="Claude Code evaluates deny before allow and specificity does not change "
+                       "that, so the deny decides every matching call and this allow widens "
+                       "nothing. The deny is effective; the allow is dead configuration.",
+                severity="low",
             ))
         return findings
 

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/safeai/analyzers/data_leakage/analyzer.py

@@ -94,6 +94,7 @@ class DataLeakageAnalyzer:
                         )
                         findings.append({
                             "rule_id": "DATA_LEAKAGE",
+                            "evidence_type": "static-pattern",  # #94 - regex patterns over source text
                             "severity": severity,
                             "message": f"Potential secret exposure: {key}",
                             "file": path,

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/safeai/analyzers/dataflow/analyzer.py

@@ -6,8 +6,14 @@ file operations). Uses line-level proxy heuristics for propagation tracking.
 
 This is a heuristic analysis — not a full interprocedural data-flow solver.
 It provides a best-effort detection of common taint patterns in agent code.
+
+Propagation is tracked within a function, and across ONE direct call to a
+function defined in the same file (#96). Cross-file flows, recursion, dynamic
+dispatch and calls made through an attribute or a variable remain out of
+scope, and are reported as such in each finding's ``limitation`` field.
 """
 
+import ast
 import re
 
 # Untrusted input sources
@@ -26,7 +32,12 @@ SINK_PATTERNS = {
     "prompt": re.compile(r"\b(?:prompt|system_prompt|user_prompt|chat_history|messages\.append)\b", re.IGNORECASE),
     "tool_call": re.compile(r"\b(?:tool_call|invoke_tool|call_tool|execute_tool)\b", re.IGNORECASE),
     "shell": re.compile(r"\b(?:subprocess|os\.system|popen|exec\(|eval\()\b", re.IGNORECASE),
-    "file_write": re.compile(r"\bopen\([^)]*[\"'](?:w|a|x)[bt+]?[\"']\b", re.IGNORECASE),
+    # The trailing \b this pattern used to carry could never match: it sat
+    # after the closing quote of the mode string, and the next character is
+    # always ')' — two non-word characters, so no boundary exists. The rule
+    # was unreachable, which is why #96's acceptance criterion could not be
+    # met without this. Found while wiring interprocedural tracking.
+    "file_write": re.compile(r"\bopen\([^)]*[\"'](?:w|a|x)[bt+]*[\"']", re.IGNORECASE),
     "http_request": re.compile(r"\b(?:requests\.(?:get|post|put|delete)|httpx\.)\b", re.IGNORECASE),
     "database": re.compile(r"\b(?:execute|cursor\.execute|query)\b", re.IGNORECASE),
 }
@@ -134,10 +145,135 @@ def _track_propagation(content, sources, sinks):
     return findings
 
 
+def _same_file_call_graph(content):
+    """Map same-file functions and the direct calls into them (#96).
+
+    Returns ``(functions, calls)`` where ``functions`` maps a function name to
+    its positional parameter names and body line span, and ``calls`` is a list
+    of direct call sites with the plain-name arguments they were given.
+
+    Deliberately shallow. Only ``def``/``async def`` at any nesting level, only
+    calls written as a bare name, and only arguments that are bare names are
+    considered — a call through an attribute (``obj.method(x)``), a variable
+    holding a function, or a computed argument is not resolved. That keeps the
+    pass conservative in the direction that matters: it can miss a real flow,
+    but it will not invent a callee.
+
+    Returns ``(None, None)`` when the file does not parse. The analyzer is run
+    over whatever is on disk, which includes files mid-edit and Python 2, and a
+    syntax error must not take the whole analyzer down.
+    """
+    try:
+        tree = ast.parse(content)
+    except (SyntaxError, ValueError, RecursionError):
+        return None, None
+
+    functions = {}
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            end = getattr(node, "end_lineno", None)
+            if end is None:  # pragma: no cover - Python < 3.8 shape
+                continue
+            functions[node.name] = {
+                "params": [a.arg for a in node.args.args],
+                "start": node.lineno,
+                "end": end,
+            }
+
+    calls = []
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        if not isinstance(node.func, ast.Name):
+            continue
+        positional = [
+            arg.id if isinstance(arg, ast.Name) else None for arg in node.args
+        ]
+        keywords = {
+            kw.arg: kw.value.id
+            for kw in node.keywords
+            if kw.arg and isinstance(kw.value, ast.Name)
+        }
+        calls.append({
+            "callee": node.func.id,
+            "line": node.lineno,
+            "positional": positional,
+            "keywords": keywords,
+        })
+
+    return functions, calls
+
+
+def _track_interprocedural(content, sources, sinks):
+    """Follow taint one call deep, within the same file (#96).
+
+    The intraprocedural pass requires the sink to appear *after* the source
+    line. That is wrong across a call boundary and not by a little: a helper is
+    usually defined ABOVE the code that calls it, so its sinks sit at lower line
+    numbers than the tainted argument. This pass therefore does not apply that
+    ordering rule to the callee body — the ordering that matters is
+    source-before-CALL, which is checked here.
+
+    One level only, and no recursion: a call inside the callee is not followed.
+    """
+    functions, calls = _same_file_call_graph(content)
+    if not functions or not calls:
+        return []
+
+    findings = []
+    for source in sources:
+        base_var = source["variable"].split(".")[0].split("(")[0]
+        if not base_var.isidentifier():
+            continue
+
+        for call in calls:
+            # The taint has to exist before it can be passed.
+            if call["line"] < source["line"]:
+                continue
+            callee = functions.get(call["callee"])
+            if callee is None:
+                continue
+
+            # Which parameter did the tainted variable land on?
+            tainted_params = [
+                callee["params"][index]
+                for index, arg in enumerate(call["positional"])
+                if arg == base_var and index < len(callee["params"])
+            ]
+            tainted_params += [
+                name for name, value in call["keywords"].items()
+                if value == base_var and name in callee["params"]
+            ]
+            if not tainted_params:
+                continue
+
+            for sink in sinks:
+                if not (callee["start"] <= sink["line"] <= callee["end"]):
+                    continue
+                if not any(
+                    re.search(rf"\b{re.escape(param)}\b", sink["sink_text"])
+                    for param in tainted_params
+                ):
+                    continue
+                findings.append({
+                    "source_line": source["line"],
+                    "source_var": base_var,
+                    "sink_line": sink["line"],
+                    "sink_type": sink["sink_type"],
+                    "source_text": source["source_text"],
+                    "sink_text": sink["sink_text"],
+                    "via_call": call["callee"],
+                    "call_line": call["line"],
+                })
+
+    return findings
+
+
 def _finding(rule_id, rule, message, path, line, evidence=None):
     """Create a data-flow finding dict, deriving severity/owasp from the rule."""
     return {
         "rule_id": rule_id,
+        "evidence_type": "static-pattern",  # #94 - line-level taint heuristic over source text
         "severity": rule.get("severity", "high"),
         "message": message,
         "file": path,
@@ -155,9 +291,11 @@ def _finding(rule_id, rule, message, path, line, evidence=None):
         "confidence": "heuristic",
         "scope": "static-analysis",
         "limitation": (
-            "Line-level proxy heuristic; not a full interprocedural data-flow "
-            "solver. May miss indirect propagation or produce false positives "
-            "on dynamic constructs."
+            "Line-level proxy heuristic. Follows taint one direct call deep "
+            "within a single file (#96); does NOT cross files, follow "
+            "recursion, resolve dynamic dispatch, or resolve a call made "
+            "through an attribute or a variable. May miss indirect "
+            "propagation or produce false positives on dynamic constructs."
         ),
     }
 
@@ -193,6 +331,9 @@ class DataFlowAnalyzer:
                 continue
 
             propagations = _track_propagation(content, sources, sinks)
+            # #96 - one call deep, same file. Appended rather than merged: the
+            # dedupe key below already collapses a flow both passes find.
+            propagations += _track_interprocedural(content, sources, sinks)
 
             for prop in propagations:
                 key = (path, prop["source_line"], prop["sink_line"], prop["sink_type"])
@@ -200,7 +341,7 @@ class DataFlowAnalyzer:
                     continue
                 seen.add(key)
 
-                rule_id = f"DATAFLOW_{prop['sink_type'].upper()}"
+                rule_id = f"DATAFLOW_{prop['sink_type']}"
                 rule = rule_map.get(rule_id, {})
                 findings.append(_finding(
                     rule_id=rule_id,
@@ -213,7 +354,15 @@ class DataFlowAnalyzer:
                     ),
                     path=path,
                     line=prop["sink_line"],
-                    evidence=f"source:{prop['source_var']}@L{prop['source_line']} -> sink:{prop['sink_type']}@L{prop['sink_line']}",
+                    evidence=(
+                        f"source:{prop['source_var']}@L{prop['source_line']} -> "
+                        + (
+                            f"call:{prop['via_call']}()@L{prop['call_line']} -> "
+                            if prop.get("via_call")
+                            else ""
+                        )
+                        + f"sink:{prop['sink_type']}@L{prop['sink_line']}"
+                    ),
                 ))
 
         return findings

{safeai_static_analyzer-1.9.1 → safeai_static_analyzer-2.0.0}/safeai/analyzers/env_dependency/analyzer.py

@@ -186,6 +186,7 @@ def _wrap_inventory(inventory, rules):
     rule = rule_map.get(INVENTORY_RULE_ID, {})
     return [{
         "rule_id": INVENTORY_RULE_ID,
+        "evidence_type": "static-config",  # #94 - inventories declared config references, names only
         "severity": rule.get("severity", "info"),
         "message": f"Referenced {len(inventory)} external configuration/credential names",
         "file": "<scan>",