coding-agent-audit 0.6.0__tar.gz → 0.6.1__tar.gz

{coding_agent_audit-0.6.0/src/coding_agent_audit.egg-info → coding_agent_audit-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.0
+Version: 0.6.1
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -227,7 +229,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than

{coding_agent_audit-0.6.0 → coding_agent_audit-0.6.1}/README.md

@@ -2,6 +2,8 @@
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -206,7 +208,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than

{coding_agent_audit-0.6.0 → coding_agent_audit-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.6.0"
+version = "0.6.1"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.6.0 → coding_agent_audit-0.6.1}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"

{coding_agent_audit-0.6.0 → coding_agent_audit-0.6.1}/src/agentaudit/mcp_server.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from typing import Optional
 
 from mcp.server.mcpserver import MCPServer
+from mcp.types import ToolAnnotations
 
 from . import __version__
 from .checks import run_all_ioc_checks
@@ -53,7 +54,22 @@ def _render(findings: list[Finding]) -> str:
     return "\n".join(lines)
 
 
-@server.tool()
+_LOCAL_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=False,
+)
+
+_NETWORK_READ_ONLY = ToolAnnotations(
+    readOnlyHint=True,
+    destructiveHint=False,
+    idempotentHint=True,
+    openWorldHint=True,
+)
+
+
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_for_known_backdoors() -> str:
     """Scan this machine for known, publicly-documented indicators of
     compromise from AI-coding-assistant supply-chain attacks (SSH backdoor
@@ -62,7 +78,7 @@ def scan_for_known_backdoors() -> str:
     return _render(run_all_ioc_checks())
 
 
-@server.tool()
+@server.tool(annotations=_LOCAL_READ_ONLY)
 def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     """Scan this machine's Claude Code / Claude Desktop / MCP config files
     for risky patterns: hooks that pipe a remote download into a shell,
@@ -80,7 +96,7 @@ def scan_mcp_config(project_dir: Optional[str] = None) -> str:
     return _render(scan_paths(paths))
 
 
-@server.tool()
+@server.tool(annotations=_NETWORK_READ_ONLY)
 def scan_phantom_dependencies(project_dir: str) -> str:
     """Check a project's package.json / requirements.txt / pyproject.toml
     dependencies against the npm/PyPI registries and flag any package name

{coding_agent_audit-0.6.0 → coding_agent_audit-0.6.1/src/coding_agent_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.6.0
+Version: 0.6.1
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -23,6 +23,8 @@ Dynamic: license-file
 
 <!-- mcp-name: io.github.stackscribe-ai/coding-agent-audit -->
 
+[![M8ven Score](https://m8ven.ai/badge/mcp/stackscribe-ai-coding-agent-audit-1xiuww?v=c2c77be885b345ce5ac975e42a68268d)](https://m8ven.ai/mcp/stackscribe-ai-coding-agent-audit-1xiuww?s=readme)
+
 A small, open-source CLI that scans your machine for:
 
 1. **Known indicators of compromise (IOCs)** from publicly documented
@@ -227,7 +229,7 @@ scan for free; this just packages it for sharing.
 
 If your agent runtime supports the open `SKILL.md` standard (Claude Code,
 Cursor, and others), a packaged version of this scan is live on the
-[Agensi skill marketplace](https://www.agensi.io/skills/coding-agent-security-audit)
+[Agensi skill marketplace](https://www.agensi.io/r/STACKSCRIBEAI?to=/skills/coding-agent-security-audit)
 as "coding agent security audit" (free) — source in
 [`agensi-skill/`](agensi-skill/). It's a zero-dependency, single-file port of
 the same checks below, meant to be loaded by an agent directly rather than