agentsec-cli 1.0.3__tar.gz → 1.0.4__tar.gz

agentsec_cli-1.0.4/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,52 @@
+---
+name: Bug Report
+about: Create a report to help us improve AgentSec
+title: "[Bug] "
+labels: bug
+assignees: ''
+---
+
+## Describe the Bug
+
+A clear and concise description of what the bug is.
+
+## To Reproduce
+
+Steps to reproduce the behavior:
+
+1. Run command: `agentsec scan ...`
+2. See error: ...
+
+## Expected Behavior
+
+A clear description of what you expected to happen.
+
+## Actual Behavior
+
+What actually happened. Include error messages, stack traces, or unexpected output.
+
+## Environment
+
+- AgentSec version: <!-- pip show agentsec-cli | grep Version -->
+- Python version: <!-- python3 --version -->
+- Operating system: <!-- e.g., Ubuntu 24.04, macOS 15, Windows 11 -->
+- Installation method: <!-- pip install, pipx, from source -->
+
+## Sample Input
+
+If applicable, provide a sanitized sample of the configuration you scanned.
+
+```json
+{
+  "mcpServers": {
+    "example": {
+      "command": "node",
+      "args": []
+    }
+  }
+}
+```
+
+## Additional Context
+
+Add any other context about the problem here.

agentsec_cli-1.0.4/.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,37 @@
+---
+name: Documentation
+about: Report a documentation issue or suggest improvement
+title: "[Docs] "
+labels: documentation
+assignees: ''
+---
+
+## Documentation Location
+
+Which page or section has the issue?
+
+- [ ] README.md
+- [ ] CHANGELOG.md
+- [ ] CONTRIBUTING.md
+- [ ] SECURITY.md
+- [ ] docs/ (MkDocs documentation)
+- [ ] CLI help output
+- [ ] Landing page
+- [ ] Other (specify):
+
+## Issue Type
+
+- [ ] Missing documentation
+- [ ] Incorrect documentation
+- [ ] Unclear documentation
+- [ ] Broken link
+- [ ] Typo / grammar
+- [ ] Outdated example
+
+## Description
+
+Describe the issue clearly.
+
+## Suggested Fix
+
+If you have a suggestion for how to fix it, include it here.

agentsec_cli-1.0.4/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,32 @@
+---
+name: Feature Request
+about: Suggest an idea for AgentSec
+title: "[Feature] "
+labels: enhancement
+assignees: ''
+---
+
+## Problem Statement
+
+Is your feature request related to a problem? Please describe what you're trying to achieve.
+
+## Proposed Solution
+
+Describe the solution you'd like. Be specific about the CLI interface, flags, or configuration.
+
+```bash
+# Example of how the feature should work
+agentsec scan . --new-flag value
+```
+
+## Alternative Solutions
+
+Describe alternatives you've considered.
+
+## Use Case
+
+Describe the real-world scenario where this feature would be useful.
+
+## Additional Context
+
+Add any other context, screenshots, or references about the feature request here.

agentsec_cli-1.0.4/.github/ISSUE_TEMPLATE/security_report.md

@@ -0,0 +1,27 @@
+---
+name: Security Report
+about: Report a security vulnerability (private)
+title: "[Security] "
+labels: security
+assignees: ''
+---
+
+**Please do not file a public issue for security vulnerabilities.**
+
+AgentSec takes security seriously. To report a vulnerability:
+
+1. **Use GitHub Private Vulnerability Reporting** under the repository's Security tab.
+2. **OR** email the maintainer directly (see SECURITY.md for contact information).
+
+## Why Private Disclosure
+
+Security vulnerabilities that are publicly disclosed without a fix can put users at risk. We will:
+
+- Acknowledge receipt within 48 hours
+- Provide a status update within 5 business days
+- Release a fix within 14 days for critical issues
+- Credit you in the security advisory (unless you request anonymity)
+
+## See Also
+
+- [SECURITY.md](../blob/main/SECURITY.md) for our full disclosure policy.

agentsec_cli-1.0.4/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,39 @@
+## Description
+
+Please include a summary of the change and which issue it addresses.
+
+Fixes # (issue)
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Performance improvement
+- [ ] Refactoring (no functional changes)
+- [ ] Test update
+- [ ] CI/CD or build process
+
+## Checklist
+
+- [ ] Tests pass (`pytest`)
+- [ ] New tests added for new functionality
+- [ ] Code follows project style (PEP 8, type hints)
+- [ ] Documentation updated (if applicable)
+- [ ] CHANGELOG entry added (if applicable)
+- [ ] Commits follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] Branch is up-to-date with `main`
+- [ ] No new warnings or errors introduced
+
+## Test Plan
+
+Describe how you tested the change:
+
+- [ ] Unit tests
+- [ ] Manual testing with `agentsec scan .`
+- [ ] Tested with sample configs (JSON, YAML, TOML)
+
+## Additional Context
+
+Add any other context about the PR here (screenshots, benchmarks, etc.).

agentsec_cli-1.0.4/.github/labels.yml

@@ -0,0 +1,51 @@
+- name: bug
+  color: d73a4a
+  description: Something isn't working
+- name: critical
+  color: b60205
+  description: Critical severity issue or finding
+- name: enhancement
+  color: a2eeef
+  description: New feature or request
+- name: feature
+  color: 0e8a16
+  description: Accepted feature to implement
+- name: ci
+  color: 0366d6
+  description: CI/CD related
+- name: build
+  color: 5319e7
+  description: Build system or packaging
+- name: documentation
+  color: 0075ca
+  description: Improvements or additions to documentation
+- name: test
+  color: 7b55d6
+  description: Testing related
+- name: refactor
+  color: fbca04
+  description: Code refactoring
+- name: performance
+  color: 0e8a16
+  description: Performance improvement
+- name: good-first-issue
+  color: 7057ff
+  description: Good for newcomers
+- name: help-wanted
+  color: 008672
+  description: Extra attention is needed
+- name: question
+  color: d876e3
+  description: Further information is requested
+- name: wontfix
+  color: ffffff
+  description: This will not be worked on
+- name: duplicate
+  color: cfd3d7
+  description: This issue or PR already exists
+- name: invalid
+  color: e4e669
+  description: This doesn't seem right
+- name: security
+  color: b60205
+  description: Security vulnerability

agentsec_cli-1.0.4/.github/workflows/agentsec.yml

@@ -0,0 +1,126 @@
+name: AgentSec CI/CD
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test / py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+      fail-fast: false
+    steps:
+      # fetch-depth: 0 is required so setuptools-scm can see the full tag
+      # history and derive the correct version. Do not remove this, and
+      # apply the same setting to any future job that installs the package.
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[dev]
+      - name: Guard against manual versioning regressions
+        run: python scripts/check_version_policy.py
+      - name: Verify CLI starts
+        run: |
+          agentsec --help
+          agentsec scan --help
+      - name: Verify version is Git-derived
+        run: |
+          agentsec --version
+      - name: Run tests
+        run: python -m pytest -v
+      - name: Smoke test — JSON output
+        run: |
+          agentsec scan . --include-hidden --format json | python -m json.tool > /dev/null
+      - name: Smoke test — SARIF output
+        run: |
+          agentsec scan . --include-hidden --format sarif | python -c "import sys,json; d=json.loads(sys.stdin.read()); assert d['version']=='2.1.0'; print(f'SARIF OK: {len(d[\"runs\"][0][\"results\"])} findings')"
+      - name: Smoke test — TOML parsing
+        run: |
+          mkdir -p /tmp/test-toml
+          printf '[mcpServers]\n[mcpServers.test]\ncommand = "bash"\n' > /tmp/test-toml/mcp.toml
+          agentsec scan /tmp/test-toml --format json | python -c "import sys,json; d=json.loads(sys.stdin.read()); assert len(d)>0; print(f'TOML scan OK: {len(d)} findings')"
+
+  build:
+    name: Build package
+    needs: test
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+      - name: Build sdist and wheel
+        run: python -m build
+      - name: Check package with twine
+        run: python -m twine check dist/*
+      - name: Verify wheel/sdist filenames match the Git tag
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          echo "Expected version from tag: $TAG_VERSION"
+          ls dist/
+          test -f "dist/agentsec_cli-${TAG_VERSION}-py3-none-any.whl"
+          test -f "dist/agentsec_cli-${TAG_VERSION}.tar.gz"
+      - name: Install and test wheel
+        run: |
+          pip install dist/*.whl
+          agentsec --version
+          agentsec scan . --format json | python -m json.tool > /dev/null
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/agentsec-cli
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    name: Create GitHub Release
+    needs: publish
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true

agentsec_cli-1.0.4/.github/workflows/docs.yml

@@ -0,0 +1,54 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'docs/CNAME'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy to GitHub Pages
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Install MkDocs
+        run: |
+          python -m pip install --upgrade pip
+          pip install mkdocs-material
+
+      - name: Build docs
+        run: mkdocs build --config-file docs/mkdocs.yml --site-dir ../site
+
+      - name: Write CNAME for custom domain
+        run: echo "agentsec.work.gd" > site/CNAME
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+
+      - name: Deploy to Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

agentsec_cli-1.0.4/.gitignore

@@ -0,0 +1,65 @@
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Python cache
+__pycache__/
+*.py[cod]
+
+# setuptools-scm generated version file (derived from Git tags at build time)
+agentsec/_version.py
+
+# Build artifacts
+build/
+dist/
+*.egg-info/
+.eggs/
+pip-wheel-metadata/
+
+# Test cache
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+
+# Type checkers / linters
+.mypy_cache/
+.ruff_cache/
+.tox/
+.nox/
+
+# IDE
+.vscode/
+.idea/
+
+# macOS / Windows
+.DS_Store
+Thumbs.db
+
+# Scan outputs
+scan_results.json
+github_scan_results.json
+*.sarif
+
+# Temporary
+*.tmp
+*.swp
+*.bak
+
+RELEASE_AUDIT.md
+RELEASE_CHECKLIST.md
+RELEASE_NOTES_v1.0.0.md
+RELEASE_VALIDATION_REPORT.md
+CI_REVIEW.md
+mcp-servers/
+
+# Internal strategy / one-time audit artifacts — content lives in Second Brain
+# (secondbrain/raw/2026-07-04_agentsec_*.md), synthesized into wiki notes.
+# Not public-repo content; kept out of git if they reappear locally.
+VISION.md
+ROADMAP_V2.md
+NEXT_HIGH_VALUE_TASKS.md
+RESEARCH_GITHUB.md
+RELEASE_AUDIT_vNEXT.md
+RELEASE_INFRASTRUCTURE_REVIEW.md

{agentsec_cli-1.0.3 → agentsec_cli-1.0.4}/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to AgentSec will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+- Migrated versioning from manually-edited version strings to
+  [`setuptools-scm`](https://setuptools-scm.readthedocs.io/). The Git tag is
+  now the single source of truth: `pyproject.toml` no longer hardcodes a
+  `version`, `agentsec/__init__.py` no longer hardcodes `__version__`, and
+  `agentsec/sarif.py` no longer hardcodes the SARIF `tool.driver.version`.
+  All three now derive from the current Git tag at build/install time via
+  `agentsec/_version.py` (generated, gitignored).
+- `agentsec --version` and the SARIF output's `tool.driver.version` now
+  report the Git-derived version (exact tag on a tagged commit, e.g. `1.0.4`;
+  a PEP 440 dev version like `1.0.4.dev5+gabcdef1` on untagged commits).
+- Release process is now exactly: `git tag vX.Y.Z && git push origin main --tags`.
+  No file edits are required to cut a release — CI builds, validates,
+  publishes to PyPI, and creates the GitHub Release automatically from the tag.
+- `.github/workflows/agentsec.yml`: `actions/checkout` now uses
+  `fetch-depth: 0` in the `test` and `build` jobs so `setuptools-scm` can see
+  the full tag history; added a step verifying the built wheel/sdist
+  filenames match the pushed tag exactly.
+
 ## [1.0.3] - 2026-07-03
 
 ### Fixed

{agentsec_cli-1.0.3 → agentsec_cli-1.0.4}/CONTRIBUTING.md

@@ -139,6 +139,56 @@ Use hyphens to separate words. Keep names short but descriptive.
 - [ ] Commits follow conventional commit format
 - [ ] Branch is up-to-date with `main`
 
+## Versioning & Releases
+
+AgentSec uses [`setuptools-scm`](https://setuptools-scm.readthedocs.io/) to
+derive its version automatically from Git tags. **The Git tag is the single
+source of truth for the version — there is no version string to edit
+anywhere in the codebase.**
+
+### Hard rule: never edit a version number manually
+
+- `pyproject.toml` declares `dynamic = ["version"]` and must **never**
+  contain a hardcoded `[project].version` field.
+- `agentsec/__init__.py`, `agentsec/sarif.py`, and every other file that
+  reports a version must obtain it dynamically (via the generated
+  `agentsec/_version.py` or `importlib.metadata`) — never hardcode a
+  version string.
+- If any file reintroduces a manually maintained version, the release
+  pipeline is broken by design: that value will inevitably drift out of
+  sync with the actual Git tag. CI enforces this automatically (see below).
+
+On a tagged commit (e.g. `v1.2.3`), the package version is exactly `1.2.3`.
+On an untagged commit, the version is a PEP 440 development version derived
+from the most recent tag plus commit distance and hash, e.g.
+`1.2.4.dev5+gabcdef1`. There is no other channel for communicating version
+intent — if you need a new version, you push a new tag.
+
+### How to cut a release
+
+A maintainer only needs to:
+
+```bash
+git commit
+git tag vX.Y.Z
+git push origin main --tags
+```
+
+Pushing the tag triggers `.github/workflows/agentsec.yml`, which
+automatically:
+
+1. Runs the full test matrix (Python 3.10–3.13).
+2. Derives the version from the pushed tag via `setuptools-scm`.
+3. Builds the sdist and wheel.
+4. Validates the package (`twine check`, filename-vs-tag check, install +
+   smoke test of the built wheel).
+5. Publishes to PyPI via Trusted Publishing (OIDC — no stored tokens).
+6. Creates the GitHub Release with auto-generated release notes.
+
+No manual version editing, no manual PyPI upload, no separate release-notes
+step. The only file a maintainer must keep current by hand is
+`CHANGELOG.md`.
+
 ## Reporting Issues
 
 ### Bug Reports

{agentsec_cli-1.0.3 → agentsec_cli-1.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentsec-cli
-Version: 1.0.3
+Version: 1.0.4
 Summary: Static security scanner for AI coding agents and MCP configurations
 Author: locface
 License-Expression: MIT
@@ -22,8 +22,10 @@ Requires-Dist: click<9,>=8.0.0
 Requires-Dist: pyyaml<7,>=6.0
 Requires-Dist: toml<1,>=0.10.2
 Requires-Dist: tomli<3,>=2.0.1; python_version < "3.11"
+Requires-Dist: pathspec<2,>=0.12
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: setuptools-scm>=8; extra == "dev"
 Dynamic: license-file
 
 <picture>

agentsec_cli-1.0.4/agentsec/__init__.py

@@ -0,0 +1,14 @@
+"""AgentSec: Static security scanner for AI coding agents and MCP configs."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    from ._version import __version__
+except ImportError:
+    # _version.py is generated by setuptools-scm at build/install time and
+    # is not present in a raw source checkout (e.g. before
+    # `pip install -e .`). Fall back to installed package metadata.
+    try:
+        __version__ = version("agentsec-cli")
+    except PackageNotFoundError:
+        __version__ = "0.0.0.dev0+unknown"

agentsec_cli-1.0.4/agentsec/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '1.0.4'
+__version_tuple__ = version_tuple = (1, 0, 4)
+
+__commit_id__ = commit_id = 'g0550ac9c6'

{agentsec_cli-1.0.3 → agentsec_cli-1.0.4}/agentsec/baseline.py

@@ -7,8 +7,8 @@ from typing import Dict, List, Tuple
 
 
 def compute_finding_id(finding: dict) -> str:
-    """Compute a stable unique ID for a finding based on rule, file, and server."""
-    key = f"{finding['rule']}|{finding['file']}|{finding.get('server', '')}"
+    """Compute a stable unique ID for a finding based on code, file, and server."""
+    key = f"{finding['code']}|{finding['file']}|{finding.get('server', '')}"
     return hashlib.md5(key.encode()).hexdigest()
 
 

{agentsec_cli-1.0.3 → agentsec_cli-1.0.4}/agentsec/cli.py

@@ -22,13 +22,17 @@ def cli():
 @click.option("--fail-on", type=click.Choice(["critical", "high", "medium", "low"], case_sensitive=False),
               help="Exit with code 1 if any finding is at least this severity")
 @click.option("--include-hidden", is_flag=True, help="Include hidden files and directories")
+@click.option("--exclude", multiple=True, default=None,
+              help="Exclude paths matching pattern (can be repeated). E.g., --exclude 'node_modules/**'")
+@click.option("--no-gitignore", is_flag=True, default=False,
+              help="Do not automatically respect .gitignore patterns")
 @click.option("--baseline", type=click.Path(exists=True, dir_okay=False, resolve_path=True),
               help="Path to baseline JSON file (lockfile). Compare findings against it.")
 @click.option("--update-baseline", type=click.Path(dir_okay=False, resolve_path=True),
               help="Save current findings as baseline JSON file and exit.")
 @click.option("--show-owasp", is_flag=True, default=False,
               help="Show OWASP Top 10 for LLM mapping IDs for each finding")
-def scan(path, format, severity, include_hidden, fail_on=None, baseline=None, update_baseline=None, show_owasp=False):
+def scan(path, format, severity, include_hidden, exclude, no_gitignore, fail_on=None, baseline=None, update_baseline=None, show_owasp=False):
     """Scan a directory for security risks in AI agent configurations."""
     # Lazy imports: scanner + parsers are only loaded when scan runs,
     # not when --help is displayed. This keeps `agentsec --help` fast
@@ -41,7 +45,9 @@ def scan(path, format, severity, include_hidden, fail_on=None, baseline=None, up
     if format == "terminal":
         click.echo(f" Scanning {path}...")
 
-    scanner = Scanner(Path(path), include_hidden=include_hidden, min_severity=severity)
+    scanner = Scanner(Path(path), include_hidden=include_hidden, min_severity=severity,
+                     exclude_patterns=list(exclude) if exclude else None,
+                     no_gitignore=no_gitignore)
     findings = scanner.scan()
 
     # If update-baseline is provided, save baseline and exit