plugin-scanner 2.0.566__tar.gz → 2.0.567__tar.gz

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.566
+Version: 2.0.567
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.566"
+version = "2.0.567"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.566"
+version = "2.0.567"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/src/codex_plugin_scanner/guard/adapters/cursor.py

@@ -9,6 +9,7 @@ from pathlib import Path
 
 from ..launcher import merge_guard_launcher_env
 from ..models import GuardArtifact, HarnessDetection
+from ..runtime.mcp_skill_firewall import enrich_artifact_with_mcp_skill_firewall
 from ..shims import ensure_guard_shim_path_in_shell_profile, install_guard_shim, remove_guard_shim
 from .base import HarnessAdapter, HarnessContext, _json_payload, _run_command_probe
 from .cursor_cli import (
@@ -88,30 +89,32 @@ class CursorHarnessAdapter(HarnessAdapter):
                 environment_payload = server_config.get("environment")
                 environment = env_payload if isinstance(env_payload, dict) else environment_payload
                 artifacts.append(
-                    GuardArtifact(
-                        artifact_id=f"cursor:{scope}:{name}",
-                        name=name,
-                        harness=self.harness,
-                        artifact_type="mcp_server",
-                        source_scope=scope,
-                        config_path=str(config_path),
-                        command=command if isinstance(command, str) else None,
-                        args=args,
-                        url=server_config.get("url") if isinstance(server_config.get("url"), str) else None,
-                        transport="http" if isinstance(server_config.get("url"), str) else "stdio",
-                        metadata={
-                            "env": {
-                                str(key): str(value)
-                                for key, value in environment.items()
-                                if isinstance(key, str) and isinstance(value, str)
-                            }
-                            if isinstance(environment, dict)
-                            else {},
-                            "guard_managed_proxy": is_guard_proxy_command(
-                                command if isinstance(command, str) else None,
-                                args,
-                            ),
-                        },
+                    enrich_artifact_with_mcp_skill_firewall(
+                        GuardArtifact(
+                            artifact_id=f"cursor:{scope}:{name}",
+                            name=name,
+                            harness=self.harness,
+                            artifact_type="mcp_server",
+                            source_scope=scope,
+                            config_path=str(config_path),
+                            command=command if isinstance(command, str) else None,
+                            args=args,
+                            url=server_config.get("url") if isinstance(server_config.get("url"), str) else None,
+                            transport="http" if isinstance(server_config.get("url"), str) else "stdio",
+                            metadata={
+                                "env": {
+                                    str(key): str(value)
+                                    for key, value in environment.items()
+                                    if isinstance(key, str) and isinstance(value, str)
+                                }
+                                if isinstance(environment, dict)
+                                else {},
+                                "guard_managed_proxy": is_guard_proxy_command(
+                                    command if isinstance(command, str) else None,
+                                    args,
+                                ),
+                            },
+                        )
                     )
                 )
         cli_available = cursor_cli_command_available(context)

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/src/codex_plugin_scanner/guard/adapters/opencode_artifacts.py

@@ -8,6 +8,7 @@ from collections.abc import Iterator
 from pathlib import Path
 
 from ..models import GuardArtifact
+from ..runtime.mcp_skill_firewall import enrich_artifact_with_mcp_skill_firewall
 from .base import HarnessContext
 
 CONFIG_FILENAMES = ("opencode.json", "opencode.jsonc")
@@ -202,13 +203,14 @@ def append_artifact(
     seen_artifact_ids: set[str],
     artifact: GuardArtifact,
 ) -> None:
-    if artifact.artifact_id in seen_artifact_ids:
+    enriched = enrich_artifact_with_mcp_skill_firewall(artifact)
+    if enriched.artifact_id in seen_artifact_ids:
         for index, existing_artifact in enumerate(artifacts):
-            if existing_artifact.artifact_id == artifact.artifact_id:
-                artifacts[index] = artifact
+            if existing_artifact.artifact_id == enriched.artifact_id:
+                artifacts[index] = enriched
                 return
-    seen_artifact_ids.add(artifact.artifact_id)
-    artifacts.append(artifact)
+    seen_artifact_ids.add(enriched.artifact_id)
+    artifacts.append(enriched)
 
 
 def append_found_path(found_paths: list[str], path: Path) -> None:

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/src/codex_plugin_scanner/guard/cli/install_commands.py

@@ -11,7 +11,8 @@ from ..adapters.base import HarnessAdapter, HarnessContext
 from ..adapters.contracts import contract_for
 from ..adapters.cursor import CursorHarnessAdapter
 from ..consumer import detect_all
-from ..runtime.skill_protection import build_skill_identity, detect_skill_content_risk
+from ..runtime.mcp_skill_firewall import build_mcp_skill_firewall_fingerprints, portal_skill_identity
+from ..runtime.skill_protection import build_skill_identity, detect_skill_content_risk, skill_identity_metadata
 from ..store import GuardStore
 from .cursor_actions import (
     cursor_install_surface,
@@ -377,13 +378,22 @@ def scan_workspace_skills(
             artifact_id = f"skill-path:{skill_path}"
             stored = store.get_snapshot("skill_scan", artifact_id)
             stored_hash = stored.get("identity_hash") if stored else None
+            skill_metadata = skill_identity_metadata(identity)
+            firewall = build_mcp_skill_firewall_fingerprints(
+                skill=portal_skill_identity(identity),
+            )
             if stored_hash == identity.identity_hash:
                 continue
             signals = detect_skill_content_risk(content, skill_path=str(skill_path))
             store.save_snapshot(
                 "skill_scan",
                 artifact_id,
-                {"identity_hash": identity.identity_hash, "skill_path": str(skill_path)},
+                {
+                    "identity_hash": identity.identity_hash,
+                    "skill_path": str(skill_path),
+                    "mcp_skill_identity": skill_metadata,
+                    "mcpSkillFirewall": firewall,
+                },
                 identity.identity_hash,
                 now,
             )

{plugin_scanner-2.0.566 → plugin_scanner-2.0.567}/src/codex_plugin_scanner/guard/mcp_tool_calls.py

@@ -19,6 +19,7 @@ from .runtime.mcp_protection import (
     mcp_server_identity_metadata,
     mcp_tool_identity_metadata,
 )
+from .runtime.mcp_skill_firewall import enrich_artifact_with_mcp_skill_firewall, scanner_evidence_for_mcp_skill_firewall
 from .store import GuardStore
 
 
@@ -71,16 +72,18 @@ def build_tool_call_artifact(
         metadata["tool_schema"] = tool_schema
     if isinstance(tool_description, str) and tool_description.strip():
         metadata["tool_description"] = tool_description.strip()
-    return GuardArtifact(
-        artifact_id=f"{harness}:runtime:{source_scope}:{server_name}:{tool_name}",
-        name=f"{server_name}:{tool_name}",
-        harness=harness,
-        artifact_type="tool_call",
-        source_scope=source_scope,
-        config_path=config_path,
-        command=tool_name,
-        transport=transport,
-        metadata=metadata,
+    return enrich_artifact_with_mcp_skill_firewall(
+        GuardArtifact(
+            artifact_id=f"{harness}:runtime:{source_scope}:{server_name}:{tool_name}",
+            name=f"{server_name}:{tool_name}",
+            harness=harness,
+            artifact_type="tool_call",
+            source_scope=source_scope,
+            config_path=config_path,
+            command=tool_name,
+            transport=transport,
+            metadata=metadata,
+        )
     )
 
 
@@ -634,6 +637,12 @@ def allow_tool_call(
         source_scope=artifact.source_scope,
         user_override="inline-approve" if decision_source == "inline-approved" else None,
         approval_source=_map_approval_source(decision_source),
+        scanner_evidence=(
+            scanner_evidence_for_mcp_skill_firewall(
+                artifact,
+                risk_categories=risk_categories,
+            ),
+        ),
     )
     store.add_receipt(receipt)
     store.add_event(
@@ -680,6 +689,12 @@ def block_tool_call(
         source_scope=artifact.source_scope,
         user_override="inline-deny" if decision_source == "inline-denied" else None,
         approval_source=_map_approval_source(decision_source),
+        scanner_evidence=(
+            scanner_evidence_for_mcp_skill_firewall(
+                artifact,
+                risk_categories=risk_categories,
+            ),
+        ),
     )
     store.add_receipt(receipt)
     store.add_event(