cycode 3.25.2.dev2__py3-none-any.whl → 3.25.2.dev4__py3-none-any.whl

cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.25.2.dev2'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.25.2.dev4'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

cycode/cli/apps/ai_guardrails/scan/handlers.py

@@ -327,10 +327,14 @@ def _check_mcp_server_authorization(payload: AIHookPayload, policy: dict) -> _Pr
         return None
 
     status = statuses.status_of(server_name)
-    if not is_enforced(status):
+    treat_unreviewed = statuses.treat_unreviewed_as_unauthorized
+    if not is_enforced(status, treat_unreviewed):
         return None
 
-    logger.debug('MCP server is not authorized, %s', {'mcp_server_name': server_name, 'status': status})
+    logger.debug(
+        'MCP server is not authorized, %s',
+        {'mcp_server_name': server_name, 'status': status, 'treat_unreviewed': treat_unreviewed},
+    )
     return _PreScanFinding(
         block_reason=BlockReason.UNAUTHORIZED_MCP_SERVER,
         mode=get_effective_mode(mcp_config, action_key='server_action'),

cycode/cli/apps/ai_guardrails/scan/mcp_server_status.py

@@ -14,7 +14,12 @@ from marshmallow import EXCLUDE, Schema, fields, post_load
 from cycode.cli.apps.ai_guardrails.scan.guardrail_config import DEFAULT_TTL_SECONDS
 from cycode.cli.consts import CYCODE_CONFIGURATION_DIRECTORY
 from cycode.cli.utils.path_utils import atomic_write_text, quarantine_corrupt_file
-from cycode.cyclient.models import McpServerAuthorizationStatus, McpServerStatus, McpServerStatusSchema
+from cycode.cyclient.models import (
+    McpServerAuthorizationStatus,
+    McpServerStatus,
+    McpServerStatusSchema,
+    TrueOnlyBoolean,
+)
 from cycode.logger import get_logger
 
 logger = get_logger('AI Guardrails')
@@ -34,8 +39,10 @@ def get_mcp_server_statuses_cache_path() -> Path:
     return Path.home() / CYCODE_CONFIGURATION_DIRECTORY / MCP_SERVER_STATUSES_FILE_NAME
 
 
-def is_enforced(status: McpServerAuthorizationStatus | None) -> bool:
+def is_enforced(status: McpServerAuthorizationStatus | None, treat_unreviewed: bool) -> bool:
     """``status`` is None when the platform never saw the server."""
+    if treat_unreviewed:
+        return status != McpServerAuthorizationStatus.AUTHORIZED
     return status == McpServerAuthorizationStatus.UNAUTHORIZED
 
 
@@ -45,6 +52,7 @@ class McpServerStatuses:
     fetched_at: float
     tenant_id: str | None = None
     ttl_seconds: float = DEFAULT_TTL_SECONDS
+    treat_unreviewed_as_unauthorized: bool = False
     _by_alias: dict = field(init=False, repr=False)
 
     def __post_init__(self) -> None:
@@ -70,6 +78,7 @@ class McpServerStatusesSchema(Schema):
     fetched_at = fields.Float(required=True)
     tenant_id = fields.String(allow_none=True, load_default=None)
     ttl_seconds = fields.Float(allow_none=True, load_default=None)
+    treat_unreviewed_as_unauthorized = TrueOnlyBoolean(data_key='should_treat_unreviewed_as_unauthorized')
 
     @post_load
     def build_dto(self, data: dict[str, Any], **_) -> McpServerStatuses:
@@ -78,10 +87,19 @@ class McpServerStatusesSchema(Schema):
 
 
 def save_mcp_server_statuses(
-    servers: list[McpServerStatus], tenant_id: str | None, ttl_seconds: float = DEFAULT_TTL_SECONDS
+    servers: list[McpServerStatus],
+    tenant_id: str | None,
+    ttl_seconds: float = DEFAULT_TTL_SECONDS,
+    treat_unreviewed_as_unauthorized: bool = False,
 ) -> None:
     path = get_mcp_server_statuses_cache_path()
-    statuses = McpServerStatuses(servers=servers, fetched_at=time.time(), tenant_id=tenant_id, ttl_seconds=ttl_seconds)
+    statuses = McpServerStatuses(
+        servers=servers,
+        fetched_at=time.time(),
+        tenant_id=tenant_id,
+        ttl_seconds=ttl_seconds,
+        treat_unreviewed_as_unauthorized=treat_unreviewed_as_unauthorized,
+    )
     try:
         path.parent.mkdir(parents=True, exist_ok=True)
         atomic_write_text(str(path), json.dumps(McpServerStatusesSchema().dump(statuses)))

cycode/cli/apps/ai_guardrails/session_start_command.py

@@ -129,7 +129,9 @@ def _report_session_context(
         _save_report_cache(digest, tenant_id)
         if response.mcp_servers is not None:
             ttl_seconds = config.ttl_seconds if config is not None else DEFAULT_TTL_SECONDS
-            save_mcp_server_statuses(response.mcp_servers, tenant_id, ttl_seconds)
+            save_mcp_server_statuses(
+                response.mcp_servers, tenant_id, ttl_seconds, response.should_treat_unreviewed_as_unauthorized
+            )
             logger.debug('MCP server statuses cache updated')
     except Exception as e:
         logger.debug('Failed to report session context', exc_info=e)

cycode/cli/consts.py

@@ -124,6 +124,7 @@ SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'deno.lock',
     'deno.json',
     'pnpm-lock.yaml',
+    'pnpm-workspace.yaml',
     'bun.lock',
     'npm-shrinkwrap.json',
     'packages.config',
@@ -189,6 +190,7 @@ PROJECT_FILES_BY_ECOSYSTEM_MAP = {
         'npm-shrinkwrap.json',
         '.npmrc',
         'pnpm-lock.yaml',
+        'pnpm-workspace.yaml',
         'bun.lock',
         'deno.lock',
         'deno.json',

cycode/cyclient/models.py

@@ -601,6 +601,13 @@ class McpServerAuthorizationStatusField(fields.Field):
         return McpServerAuthorizationStatus.parse(None if value is missing else value)
 
 
+class TrueOnlyBoolean(fields.Boolean):
+    """Anything but a literal true reads as False, so a malformed flag never tightens enforcement."""
+
+    def deserialize(self, value: object, *_, **__) -> bool:
+        return value is True
+
+
 @dataclass
 class McpServerStatus:
     alias: str | None = None
@@ -625,6 +632,8 @@ class McpServerStatusSchema(Schema):
 class SessionContextResponse:
     # None when the response carries no (or malformed) MCP server statuses.
     mcp_servers: list[McpServerStatus] | None = None
+    # Strict mode: Unreviewed servers count as Unauthorized.
+    should_treat_unreviewed_as_unauthorized: bool = False
 
 
 class SessionContextResponseSchema(Schema):
@@ -632,6 +641,7 @@ class SessionContextResponseSchema(Schema):
         unknown = EXCLUDE
 
     mcp_servers = fields.List(fields.Nested(McpServerStatusSchema), allow_none=True, load_default=None)
+    should_treat_unreviewed_as_unauthorized = TrueOnlyBoolean()
 
     @post_load
     def build_dto(self, data: dict[str, Any], **_) -> SessionContextResponse:

{cycode-3.25.2.dev2.dist-info → cycode-3.25.2.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.25.2.dev2
+Version: 3.25.2.dev4
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.25.2.dev2.dist-info → cycode-3.25.2.dev4.dist-info}/RECORD

@@ -1,4 +1,4 @@
-cycode/__init__.py,sha256=wJ8aEY50gYDz0qyJPREJI85aAXCUaQxHqdslewq6rd4,396
+cycode/__init__.py,sha256=WFOG1meth_l-N9dkT3YvvkSOCUuMykZZ8eCvWSDBFCk,396
 cycode/__main__.py,sha256=Z3bD5yrA7yPvAChcADQrqCaZd0ChGI1gdiwALwbWJ6U,104
 cycode/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/app.py,sha256=sI6wBHmfo7RchO9rnOXaQyUHRG9fm4r9aIduV4ZOD5c,10167
@@ -21,14 +21,14 @@ cycode/cli/apps/ai_guardrails/scan/__init__.py,sha256=qJc82XiQGiAuc1sYY8Ij_A-qXp
 cycode/cli/apps/ai_guardrails/scan/consts.py,sha256=8H8JXlgm65sYkgTXqsBInHhHe80UPjqY4vumZXB4GGM,1060
 cycode/cli/apps/ai_guardrails/scan/detach.py,sha256=8BRgBq9Qi8nXEx6NKlE8scSRPkO30XCfsiI5PLvq6Gk,2700
 cycode/cli/apps/ai_guardrails/scan/guardrail_config.py,sha256=cU5DqsPvt_dejkiDhbN7ve--1LlT-VuQvLv70kWUtJs,7911
-cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=u8MRB9krA9MgrBdnnC2zxgy2CfhdHAfdemEs0Mt3hoo,20505
-cycode/cli/apps/ai_guardrails/scan/mcp_server_status.py,sha256=DLC-L-euqclpQw-fH8cOk1-zcIptz0M0wJgOK_pEiTI,3870
+cycode/cli/apps/ai_guardrails/scan/handlers.py,sha256=qGghjMm82NlB5rnDVQ-5i79JDuZKvu-VU3MNABcrV8A,20649
+cycode/cli/apps/ai_guardrails/scan/mcp_server_status.py,sha256=44wij2VtjsB7cffxEnEBqQ5RInmzLROwOC0VwtDRl4s,4355
 cycode/cli/apps/ai_guardrails/scan/payload.py,sha256=dyxhrTdSiVuODlzRR3RJFAeiP3zTL6Lt_5Wteng9f7k,1467
 cycode/cli/apps/ai_guardrails/scan/policy.py,sha256=nqLjWqNty-p4pk4mSCyy7EfqavUNCdP3nUSkKC7QRMY,4984
 cycode/cli/apps/ai_guardrails/scan/scan_command.py,sha256=WKRlg6ubwUPkyAnJDu6q9JWMtmN4ZuBM8-y9P7fGi6c,8286
 cycode/cli/apps/ai_guardrails/scan/types.py,sha256=6nh_40KSTuWabsaVqkZEl712m6lAI8k9OuhPo8KhJdw,1553
 cycode/cli/apps/ai_guardrails/scan/utils.py,sha256=4CIZAILS9m5-JsFbUderwBVzFAjqAVVVRhWgE9oLPhM,5292
-cycode/cli/apps/ai_guardrails/session_start_command.py,sha256=lEKE5InZv1DgG_27SFw55_UVvgKnIUII_xHRfWkbnDU,8233
+cycode/cli/apps/ai_guardrails/session_start_command.py,sha256=1TsTK_SY6dp-iILCIqzxVFV0oHFtyyrg6fDIOV96stQ,8313
 cycode/cli/apps/ai_guardrails/status_command.py,sha256=OXWnGhFwt4zILbtGHWnB6Bh-Z3OhcgKDGQW6e-7QyHU,3190
 cycode/cli/apps/ai_guardrails/uninstall_command.py,sha256=po-Uh-U5itNOPPAG7wAfBLEB85DvZX1VMUVS-pgHX64,2685
 cycode/cli/apps/ai_remediation/__init__.py,sha256=8vYthY9RQeJqEni3AIF5sryz8n-XJQ6VNqG4aEFBAdY,553
@@ -99,7 +99,7 @@ cycode/cli/apps/status/version_command.py,sha256=c6Iko_rmZo9T_kQSd3HUloBi40Qv7cj
 cycode/cli/cli_types.py,sha256=Xqf2eSx3yUvFoQG29ObUZ3QLVBhtZ4mkqxf_cJXpntU,3406
 cycode/cli/config.py,sha256=Op-lX_neanJtvPvoOEx4ByBdveh5ygElIga1FdSHhOI,299
 cycode/cli/console.py,sha256=fsKqkOQCkvVn34Vf0XYBjXwKbK51J_Ic7mLBFUtsjzI,1901
-cycode/cli/consts.py,sha256=jI1M2PolPIIodJMphQYrTbzCOrjO3umjb6R92h1Ntww,11163
+cycode/cli/consts.py,sha256=gYldShCpOT1m6_wi2LVgdPbl9sMxOs7o7KMYFj_QqHo,11221
 cycode/cli/exceptions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 cycode/cli/exceptions/custom_exceptions.py,sha256=Mvjfkww2mmMBBCD4OWAkSfl_9iOvi4bLTLGLBL7OdOk,5423
 cycode/cli/exceptions/handle_ai_remediation_errors.py,sha256=mA70upSYXK3rL_fmanzKYeUzLENhpXdkW8k3aIHrKzU,785
@@ -219,13 +219,13 @@ cycode/cyclient/cycode_token_based_client.py,sha256=frbrv1jzF388SXqHNNkZ95Hbx7Vj
 cycode/cyclient/headers.py,sha256=Ktmn7cPsFXcPYdQMmkURmcHZBmjwWMRY1TZ_x1f7JBQ,1306
 cycode/cyclient/import_sbom_client.py,sha256=AvEa6APERHGT-1v3LtENuekrse7tGgLr18Dma5WHTA0,2731
 cycode/cyclient/logger.py,sha256=oTkay7QzoOIVQ71cGOy4ukkijYGA3IKJlHkL24Px5ds,70
-cycode/cyclient/models.py,sha256=s7nR_Ih_Q0OKCgLood_MZLuxjreI5ydCbLNgjrNCFz8,17526
+cycode/cyclient/models.py,sha256=4JjBL7kxkoztXvbFy9fy67JZ0U8z6bMDabp4HN9uQD0,17942
 cycode/cyclient/report_client.py,sha256=PaKEo6Q0GFVdpNC18vvR4uBoUX1MnllVmKkS72eAPmk,4368
 cycode/cyclient/scan_client.py,sha256=AZ-3G9eC8Y_-jjivllP7ESPpdLds0Dkl4-KIxe5jNyE,16944
 cycode/cyclient/scan_config_base.py,sha256=mXsPZGYCtp85rv5GIige40yQZXuRcEKUW-VQJ0vgFzk,1201
 cycode/logger.py,sha256=OHmfkf4dnyZgfixGqkWf3js3uysrOXU_4cS8TChtAzc,2079
-cycode-3.25.2.dev2.dist-info/METADATA,sha256=QAcKCvKqyWmRco-Ra32SRZ28vrmWxPbOorYqBj-e7Yk,96119
-cycode-3.25.2.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
-cycode-3.25.2.dev2.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
-cycode-3.25.2.dev2.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
-cycode-3.25.2.dev2.dist-info/RECORD,,
+cycode-3.25.2.dev4.dist-info/METADATA,sha256=jKryL6ABnTfBmYrFv2Pt5Pbv1AMlsVUCXU0voRQOQ-Y,96119
+cycode-3.25.2.dev4.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+cycode-3.25.2.dev4.dist-info/entry_points.txt,sha256=iDcVJM8ByLElVgvBgtYxDjw1kT7O8Mo0LcWZIT5L3Ig,45
+cycode-3.25.2.dev4.dist-info/licenses/LICENCE,sha256=2Wx4N6mD_4xB7-E3hPkZ3MPhpJy__k_I8MaCSO-PDRo,1068
+cycode-3.25.2.dev4.dist-info/RECORD,,