agentsec-cli 0.1.0__tar.gz → 1.0.0__tar.gz

agentsec_cli-1.0.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# CHANGELOG
+
+All notable changes to AgentSec will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-07-02
+
+### Added
+
+- Initial public release.
+- 41 security rules for MCP, Cursor, Claude Desktop, Codex, Cline, and Continue configurations.
+- CLI interface with `scan` command.
+- Output formats: terminal, JSON, SARIF, Markdown.
+- OWASP Top 10 for LLM Applications (LLM01–LLM10) mapping on every rule.
+- OWASP Agentic Security Top 10 (AG01–AG10) mapping on applicable rules.
+- CI/CD gating with `--fail-on critical|high|medium|low`.
+- Baseline/lockfile support with `--baseline` and `--update-baseline`.
+- SARIF v2.1.0 output for GitHub CodeQL integration.
+- Support for JSON, YAML, TOML, Markdown config files.
+- Automatic detection of MCP server manifests, Claude Desktop configs, Cursor rules, Codex configs, Cline configs, and agent instruction files.
+- MkDocs documentation (installation, usage, rules reference, OWASP mapping, FAQ, CI/CD).
+- Landing page at https://locface.github.io/AgentSec/.
+- PyPI package `agentsec-cli`.
+
+### Security
+
+- Every security rule is mapped to industry-standard OWASP frameworks.
+- No LLM dependencies — purely static analysis, zero data leakage.

agentsec_cli-1.0.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,133 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+locface (via GitHub Issues).
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

agentsec_cli-1.0.0/CONTRIBUTING.md

@@ -0,0 +1,177 @@
+# Contributing to AgentSec
+
+Thank you for considering contributing to AgentSec. This document outlines the process for contributing code, reporting issues, and improving documentation.
+
+## Table of Contents
+
+- [Development Setup](#development-setup)
+- [Running Tests](#running-tests)
+- [Code Style](#code-style)
+- [Commit Style](#commit-style)
+- [Branch Naming](#branch-naming)
+- [Pull Request Workflow](#pull-request-workflow)
+- [Reporting Issues](#reporting-issues)
+- [Review Process](#review-process)
+
+## Development Setup
+
+### Prerequisites
+
+- Python 3.10 or later
+- git
+
+### Setup
+
+```bash
+# Clone the repository
+git clone https://github.com/locface/AgentSec.git
+cd AgentSec
+
+# Create a virtual environment
+python3 -m venv .venv
+source .venv/bin/activate
+
+# Install in development mode
+pip install -e .[dev]
+
+# Verify installation
+agentsec --help
+```
+
+## Running Tests
+
+```bash
+# Run all tests
+pytest
+
+# Run with verbose output
+pytest -v
+
+# Run a specific test file
+pytest tests/test_baseline.py
+
+# Run tests with coverage
+pip install pytest-cov
+pytest --cov=agentsec
+```
+
+Tests are located in the `tests/` directory. Each test file follows the `test_*.py` naming convention.
+
+### Writing Tests
+
+- Place test files in `tests/`
+- Name test files `test_<module>.py`
+- Use descriptive test function names
+- Use fixtures for sample configs (see `tests/fixtures/`)
+- Test each rule independently
+- Prefer behavioral assertions over snapshot comparisons
+
+## Code Style
+
+- Follow [PEP 8](https://peps.python.org/pep-0008/) for Python code.
+- Use type hints for all function signatures.
+- Maximum line length: 100 characters.
+- Use descriptive variable names — avoid single-letter names except in comprehensions.
+- Prefer `pathlib.Path` over `os.path`.
+- Use `pathlib.Path` for file operations.
+- Keep functions focused and small.
+
+## Commit Style
+
+We follow [Conventional Commits](https://www.conventionalcommits.org/):
+
+```
+<type>: <description>
+
+[optional body]
+```
+
+Types:
+
+- `feat:` — new feature
+- `fix:` — bug fix
+- `docs:` — documentation only
+- `style:` — formatting, missing semicolons, etc.
+- `refactor:` — code change that neither fixes a bug nor adds a feature
+- `test:` — adding or modifying tests
+- `chore:` — build process, dependencies, etc.
+- `perf:` — performance improvement
+- `ci:` — CI configuration
+- `security:` — security fixes
+
+Examples:
+
+```
+feat: add --fail-on flag for CI gating
+fix: handle missing server field in json output
+docs: add SARIF integration example
+```
+
+## Branch Naming
+
+- `feat/<short-description>` — new features
+- `fix/<short-description>` — bug fixes
+- `docs/<short-description>` — documentation
+- `chore/<short-description>` — maintenance
+
+Use hyphens to separate words. Keep names short but descriptive.
+
+## Pull Request Workflow
+
+1. Fork the repository.
+2. Create a branch from `main`.
+3. Make your changes.
+4. Run tests: `pytest`.
+5. Ensure your code follows the style guide.
+6. Commit using conventional commit format.
+7. Push your branch and open a pull request.
+8. In the PR description, explain what the change does and why.
+9. Ensure CI passes.
+10. Request review from a maintainer.
+
+### Pull Request Checklist
+
+- [ ] Tests pass (`pytest`)
+- [ ] New tests added for new functionality
+- [ ] Code follows project style
+- [ ] Documentation updated (if applicable)
+- [ ] CHANGELOG entry added (if applicable)
+- [ ] Commits follow conventional commit format
+- [ ] Branch is up-to-date with `main`
+
+## Reporting Issues
+
+### Bug Reports
+
+When filing a bug report, include:
+
+- AgentSec version (`agentsec --version` or `pip show agentsec-cli`)
+- Python version
+- Operating system
+- Steps to reproduce
+- Expected behavior
+- Actual behavior
+- Sample input (if possible, sanitize sensitive data)
+
+### Feature Requests
+
+When requesting a feature, describe:
+
+- What you want to do
+- Why existing functionality doesn't cover it
+- How you envision the feature working (API, flags, etc.)
+
+### Security Issues
+
+For security vulnerabilities, **do not** file a public issue. Instead, follow the process in [SECURITY.md](./SECURITY.md).
+
+## Review Process
+
+1. A maintainer will review your PR within a few days.
+2. Address any feedback with additional commits.
+3. Once approved, a maintainer will merge your PR.
+4. The change will be included in the next release.
+
+## Questions?
+
+If you have questions, open a [Discussion](https://github.com/locface/AgentSec/discussions) or reach out via the issue tracker.

agentsec_cli-1.0.0/MANIFEST.in

@@ -0,0 +1,8 @@
+include README.md
+include LICENSE
+include CHANGELOG.md
+include SECURITY.md
+include CONTRIBUTING.md
+include CODE_OF_CONDUCT.md
+include pyproject.toml
+recursive-include agentsec *.py