sec-report-kit 0.1.2__py3-none-any.whl

sec_report_kit/__init__.py

@@ -0,0 +1,4 @@
+"""sec_report_kit package."""
+
+__all__ = ["__version__"]
+__version__ = "0.1.0"

sec_report_kit/__main__.py

@@ -0,0 +1,5 @@
+from sec_report_kit.cli import main
+
+
+if __name__ == "__main__":
+    main()

sec_report_kit/cli.py

@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from sec_report_kit.parsers import detect_source_type
+from sec_report_kit.parsers.pip_audit import parse_pip_audit_json
+from sec_report_kit.parsers.trivy import parse_trivy_json
+from sec_report_kit.report.html_renderer import render_html_report
+from sec_report_kit.services.summarize import count_by_severity, sort_findings
+
+app = typer.Typer(help="Security report kit CLI")
+render_app = typer.Typer(help="Render HTML reports")
+mcp_app = typer.Typer(help="MCP server commands")
+app.add_typer(render_app, name="render")
+app.add_typer(mcp_app, name="mcp")
+
+
+def _load_json(path: Path) -> dict:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def _write_report(source_label: str, target_ref: str, input_path: Path, output_path: Path, parser: str) -> None:
+    payload = _load_json(input_path)
+    if parser == "auto":
+        parser = detect_source_type(payload)
+        typer.echo(f"[INFO] Detected source type: {parser}")
+    if parser == "trivy":
+        findings = parse_trivy_json(payload)
+    elif parser == "pip-audit":
+        findings = parse_pip_audit_json(payload)
+    else:
+        raise typer.BadParameter(f"Unsupported parser: {parser}")
+
+    findings = sort_findings(findings)
+    counts = count_by_severity(findings)
+    report_html = render_html_report(target_ref=target_ref, source_label=source_label, findings=findings, counts=counts)
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_text(report_html, encoding="utf-8")
+
+    typer.echo(f"[OK] Report generated: {output_path}")
+    typer.echo(f"[INFO] Total findings: {len(findings)}")
+    typer.echo(f"[INFO] Severity counts: {counts}")
+
+
+@render_app.command("trivy")
+def render_trivy(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option(..., "--target", help="Scanned image or artifact reference"),
+) -> None:
+    """Render HTML report from Trivy JSON output."""
+    _write_report("trivy", target, input, output, parser="trivy")
+
+
+@render_app.command("pip-audit")
+def render_pip_audit(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option("python-environment", "--target", help="Python environment target label"),
+) -> None:
+    """Render HTML report from pip-audit JSON output."""
+    _write_report("pip-audit", target, input, output, parser="pip-audit")
+
+
+@render_app.command("auto")
+def render_auto(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option("unknown", "--target", help="Scanned image or artifact reference"),
+) -> None:
+    """Auto-detect input format (Trivy or pip-audit) and render HTML report."""
+    _write_report("auto", target, input, output, parser="auto")
+
+
+@mcp_app.command("serve")
+def serve_mcp(
+    transport: str = typer.Option("stdio", "--transport", help="MCP transport (currently stdio)")
+) -> None:
+    """Run the MCP server."""
+    from sec_report_kit.mcp.server import run_server
+
+    run_server(transport=transport)
+
+
+def main() -> None:
+    app()
+
+
+if __name__ == "__main__":
+    main()

sec_report_kit/mcp/__init__.py

@@ -0,0 +1 @@
+"""MCP server integration."""

sec_report_kit/mcp/server.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from sec_report_kit.parsers import detect_source_type
+from sec_report_kit.parsers.pip_audit import parse_pip_audit_json
+from sec_report_kit.parsers.trivy import parse_trivy_json
+from sec_report_kit.report.html_renderer import render_html_report
+from sec_report_kit.services.summarize import count_by_severity, sort_findings
+
+
+def _load_payload(source_type: str, input_path: str):
+    data = json.loads(Path(input_path).read_text(encoding="utf-8"))
+    if source_type == "auto":
+        source_type = detect_source_type(data)
+    if source_type == "trivy":
+        return sort_findings(parse_trivy_json(data))
+    if source_type == "pip-audit":
+        return sort_findings(parse_pip_audit_json(data))
+    raise ValueError("source_type must be 'trivy', 'pip-audit', or 'auto'")
+
+
+def build_server():
+    try:
+        from mcp.server.fastmcp import FastMCP
+    except Exception as exc:  # pragma: no cover
+        raise RuntimeError(
+            "MCP dependencies are not installed. Install with: pip install sec-report-kit[mcp]"
+        ) from exc
+
+    mcp = FastMCP("sec-report-kit")
+
+    @mcp.tool()
+    def summarize_json(source_type: str, input_path: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        counts = count_by_severity(findings)
+        return {"total": len(findings), "counts": counts}
+
+    @mcp.tool()
+    def render_report_from_json(source_type: str, input_path: str, output_path: str, target: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        counts = count_by_severity(findings)
+        html = render_html_report(target_ref=target, source_label=source_type, findings=findings, counts=counts)
+        out = Path(output_path)
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(html, encoding="utf-8")
+        return {"output_path": str(out), "total": len(findings), "counts": counts}
+
+    @mcp.tool()
+    def validate_input(source_type: str, input_path: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        return {"valid": True, "total_findings": len(findings)}
+
+    return mcp
+
+
+def run_server(transport: str = "stdio") -> None:
+    mcp = build_server()
+    if transport != "stdio":
+        raise ValueError("Only stdio transport is currently supported")
+    mcp.run(transport="stdio")

sec_report_kit/models.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class Finding:
+    source_type: str
+    target: str
+    severity: str
+    vulnerability_id: str
+    package: str
+    installed_version: str
+    fixed_version: str
+    title: str
+    primary_url: str

sec_report_kit/parsers/__init__.py

@@ -0,0 +1,18 @@
+"""Input format parsers."""
+
+
+def detect_source_type(data: dict) -> str:
+    """Detect whether *data* came from Trivy or pip-audit.
+
+    Returns ``"trivy"`` or ``"pip-audit"``.
+    Raises ``ValueError`` if the format cannot be recognised.
+    """
+    if isinstance(data, dict):
+        if "Results" in data:
+            return "trivy"
+        if "dependencies" in data or "vulnerabilities" in data:
+            return "pip-audit"
+    raise ValueError(
+        "Cannot detect source type: JSON does not match any known format "
+        "(expected 'Results' for Trivy or 'dependencies'/'vulnerabilities' for pip-audit)."
+    )

sec_report_kit/parsers/pip_audit.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import normalize_severity
+
+
+def _best_url(vuln: dict) -> str:
+    if vuln.get("url"):
+        return str(vuln["url"])
+    if vuln.get("advisory"):
+        return str(vuln["advisory"])
+    if vuln.get("links") and isinstance(vuln["links"], list):
+        return str(vuln["links"][0]) if vuln["links"] else ""
+    return ""
+
+
+def _fixed_version(vuln: dict) -> str:
+    fixes = vuln.get("fix_versions")
+    if isinstance(fixes, list) and fixes:
+        return ", ".join(str(value) for value in fixes)
+    fixed = vuln.get("fixed_version")
+    return str(fixed) if fixed else "-"
+
+
+def parse_pip_audit_json(data: dict) -> list[Finding]:
+    findings: list[Finding] = []
+
+    dependencies = data.get("dependencies", []) if isinstance(data, dict) else []
+    for dep in dependencies:
+        package = dep.get("name", "-")
+        installed = dep.get("version", "-")
+        for vuln in dep.get("vulns", []) or []:
+            findings.append(
+                Finding(
+                    source_type="python-pkg",
+                    target="Python",
+                    severity=normalize_severity(vuln.get("severity")),
+                    vulnerability_id=str(vuln.get("id") or "-"),
+                    package=str(package),
+                    installed_version=str(installed),
+                    fixed_version=_fixed_version(vuln),
+                    title=str(vuln.get("description") or vuln.get("summary") or "-"),
+                    primary_url=_best_url(vuln),
+                )
+            )
+
+    # Some tools may output a flat list under "vulnerabilities"; support that too.
+    if not findings and isinstance(data, dict) and isinstance(data.get("vulnerabilities"), list):
+        for vuln in data["vulnerabilities"]:
+            findings.append(
+                Finding(
+                    source_type="python-pkg",
+                    target="Python",
+                    severity=normalize_severity(vuln.get("severity")),
+                    vulnerability_id=str(vuln.get("id") or "-"),
+                    package=str(vuln.get("package") or "-"),
+                    installed_version=str(vuln.get("installed_version") or "-"),
+                    fixed_version=_fixed_version(vuln),
+                    title=str(vuln.get("description") or vuln.get("summary") or "-"),
+                    primary_url=_best_url(vuln),
+                )
+            )
+
+    return findings

sec_report_kit/parsers/trivy.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import normalize_severity
+
+
+def parse_trivy_json(data: dict) -> list[Finding]:
+    findings: list[Finding] = []
+    for result in data.get("Results", []):
+        target = result.get("Target", "unknown")
+        source_type = result.get("Type", "unknown")
+        for vuln in result.get("Vulnerabilities", []) or []:
+            findings.append(
+                Finding(
+                    source_type=source_type,
+                    target=target,
+                    severity=normalize_severity(vuln.get("Severity")),
+                    vulnerability_id=vuln.get("VulnerabilityID", "-"),
+                    package=vuln.get("PkgName", "-"),
+                    installed_version=vuln.get("InstalledVersion", "-"),
+                    fixed_version=vuln.get("FixedVersion") or "-",
+                    title=vuln.get("Title") or "-",
+                    primary_url=vuln.get("PrimaryURL") or "",
+                )
+            )
+    return findings

sec_report_kit/report/__init__.py

@@ -0,0 +1 @@
+"""Report renderers."""

sec_report_kit/report/html_renderer.py

@@ -0,0 +1,206 @@
+from __future__ import annotations
+
+import datetime as dt
+import html
+
+from sec_report_kit.models import Finding
+
+
+def _esc(value: str) -> str:
+    return html.escape(value, quote=True)
+
+
+def render_html_report(target_ref: str, source_label: str, findings: list[Finding], counts: dict[str, int]) -> str:
+    generated_at = dt.datetime.now(dt.timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
+    total = len(findings)
+
+    rows = []
+    for item in findings:
+        vuln_id = _esc(item.vulnerability_id)
+        if item.primary_url:
+            vuln_cell = (
+                f'<a href="{_esc(item.primary_url)}" target="_blank" rel="noopener noreferrer">{vuln_id}</a>'
+            )
+        else:
+            vuln_cell = vuln_id
+
+        rows.append(
+            "<tr>"
+            f"<td class=\"sev {_esc(item.severity).lower()}\">{_esc(item.severity)}</td>"
+            f"<td>{vuln_cell}</td>"
+            f"<td>{_esc(item.package)}</td>"
+            f"<td>{_esc(item.installed_version)}</td>"
+            f"<td>{_esc(item.fixed_version)}</td>"
+            f"<td>{_esc(item.title)}</td>"
+            f"<td>{_esc(item.target)}</td>"
+            f"<td>{_esc(item.source_type)}</td>"
+            "</tr>"
+        )
+
+    rows_html = "\n".join(rows) if rows else "<tr><td colspan=\"8\">No vulnerabilities found.</td></tr>"
+
+    return f"""<!doctype html>
+<html lang=\"en\">
+<head>
+  <meta charset=\"utf-8\" />
+  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />
+  <title>Security Report</title>
+  <style>
+    body {{ font-family: Segoe UI, Arial, sans-serif; margin: 24px; color: #1f2937; }}
+    h1 {{ margin: 0 0 8px 0; }}
+    .meta {{ margin-bottom: 18px; color: #4b5563; }}
+    .cards {{ display: grid; grid-template-columns: repeat(6, minmax(110px, 1fr)); gap: 10px; margin-bottom: 18px; }}
+    .card {{ border: 1px solid #d1d5db; border-radius: 8px; padding: 10px 12px; background: #f9fafb; }}
+    .label {{ font-size: 12px; color: #6b7280; text-transform: uppercase; }}
+    .value {{ font-size: 24px; font-weight: 700; margin-top: 4px; }}
+    .filters {{ display: flex; flex-wrap: wrap; gap: 10px; margin-bottom: 14px; align-items: center; }}
+    .filters label {{ font-size: 13px; color: #374151; display: flex; flex-direction: column; gap: 3px; }}
+    .filters select, .filters input[type=text] {{
+      font-size: 13px; padding: 5px 8px; border: 1px solid #d1d5db;
+      border-radius: 6px; background: #fff; color: #1f2937; min-width: 140px;
+    }}
+    .filters input[type=text] {{ min-width: 220px; }}
+    .filters button {{
+      font-size: 13px; padding: 6px 14px; border: 1px solid #d1d5db;
+      border-radius: 6px; background: #f3f4f6; cursor: pointer; color: #374151;
+      align-self: flex-end;
+    }}
+    .filters button:hover {{ background: #e5e7eb; }}
+    #result-count {{ font-size: 13px; color: #6b7280; align-self: flex-end; margin-left: auto; }}
+    table {{ width: 100%; border-collapse: collapse; font-size: 13px; }}
+    thead th {{ text-align: left; border-bottom: 2px solid #d1d5db; padding: 8px; background: #f3f4f6; position: sticky; top: 0; }}
+    tbody td {{ border-bottom: 1px solid #e5e7eb; padding: 8px; vertical-align: top; }}
+    tbody tr.hidden {{ display: none; }}
+    .sev {{ font-weight: 700; }}
+    .critical {{ color: #b91c1c; }}
+    .high {{ color: #c2410c; }}
+    .medium {{ color: #b45309; }}
+    .low {{ color: #1d4ed8; }}
+    .unknown {{ color: #6b7280; }}
+    a {{ color: #1d4ed8; text-decoration: none; }}
+    a:hover {{ text-decoration: underline; }}
+  </style>
+</head>
+<body>
+  <h1>Security Vulnerability Report</h1>
+  <div class=\"meta\">Source: <strong>{_esc(source_label)}</strong> | Target: <strong>{_esc(target_ref)}</strong> | Generated: {_esc(generated_at)}</div>
+
+  <div class=\"cards\">
+    <div class=\"card\"><div class=\"label\">Total</div><div class=\"value\">{total}</div></div>
+    <div class=\"card\"><div class=\"label\">Critical</div><div class=\"value critical\">{counts['CRITICAL']}</div></div>
+    <div class=\"card\"><div class=\"label\">High</div><div class=\"value high\">{counts['HIGH']}</div></div>
+    <div class=\"card\"><div class=\"label\">Medium</div><div class=\"value medium\">{counts['MEDIUM']}</div></div>
+    <div class=\"card\"><div class=\"label\">Low</div><div class=\"value low\">{counts['LOW']}</div></div>
+    <div class=\"card\"><div class=\"label\">Unknown</div><div class=\"value unknown\">{counts['UNKNOWN']}</div></div>
+  </div>
+
+  <div class=\"filters\">
+    <label>Severity
+      <select id=\"f-severity\">
+        <option value=\"\">All</option>
+        <option value=\"critical\">Critical</option>
+        <option value=\"high\">High</option>
+        <option value=\"medium\">Medium</option>
+        <option value=\"low\">Low</option>
+        <option value=\"unknown\">Unknown</option>
+      </select>
+    </label>
+    <label>Vulnerability ID
+      <input type=\"text\" id=\"f-vuln\" placeholder=\"e.g. CVE-2024-\" />
+    </label>
+    <label>Package
+      <input type=\"text\" id=\"f-pkg\" placeholder=\"e.g. openssl\" />
+    </label>
+    <label>Target
+      <input type=\"text\" id=\"f-target\" placeholder=\"e.g. usr/lib\" />
+    </label>
+    <label>Type
+      <input type=\"text\" id=\"f-type\" placeholder=\"e.g. os-pkgs\" />
+    </label>
+    <label>Title / keyword
+      <input type=\"text\" id=\"f-title\" placeholder=\"e.g. buffer overflow\" />
+    </label>
+    <button onclick=\"clearFilters()\">Clear</button>
+    <span id=\"result-count\"></span>
+  </div>
+
+  <table id=\"vuln-table\">
+    <thead>
+      <tr>
+        <th>Severity</th>
+        <th>Vulnerability</th>
+        <th>Package</th>
+        <th>Installed</th>
+        <th>Fixed</th>
+        <th>Title</th>
+        <th>Target</th>
+        <th>Type</th>
+      </tr>
+    </thead>
+    <tbody id=\"vuln-body\">
+      {rows_html}
+    </tbody>
+  </table>
+
+  <script>
+    const filterIds = ['f-severity', 'f-vuln', 'f-pkg', 'f-target', 'f-type', 'f-title'];
+    // col indices: severity=0, vuln=1, pkg=2, installed=3, fixed=4, title=5, target=6, type=7
+    const colMap = {{ 'f-severity': 0, 'f-vuln': 1, 'f-pkg': 2, 'f-target': 6, 'f-type': 7, 'f-title': 5 }};
+
+    function applyFilters() {{
+      const filters = {{}};
+      filterIds.forEach(id => {{
+        const el = document.getElementById(id);
+        filters[id] = el.value.trim().toLowerCase();
+      }});
+
+      const rows = document.querySelectorAll('#vuln-body tr');
+      let visible = 0;
+      rows.forEach(row => {{
+        const cells = row.querySelectorAll('td');
+        if (!cells.length) return;
+        let show = true;
+        for (const [id, col] of Object.entries(colMap)) {{
+          const val = filters[id];
+          if (!val) continue;
+          const cellText = (cells[col]?.textContent || '').trim().toLowerCase();
+          if (id === 'f-severity') {{
+            if (cellText !== val) {{ show = false; break; }}
+          }} else {{
+            if (!cellText.includes(val)) {{ show = false; break; }}
+          }}
+        }}
+        row.classList.toggle('hidden', !show);
+        if (show) visible++;
+      }});
+
+      const total = rows.length;
+      document.getElementById('result-count').textContent =
+        visible === total ? `${{total}} rows` : `${{visible}} of ${{total}} rows`;
+    }}
+
+    function clearFilters() {{
+      filterIds.forEach(id => {{ document.getElementById(id).value = ''; }});
+      applyFilters();
+    }}
+
+    filterIds.forEach(id => {{
+      const el = document.getElementById(id);
+      el.addEventListener('input', applyFilters);
+      el.addEventListener('change', applyFilters);
+    }});
+
+    applyFilters();
+  </script>
+
+  <footer style="margin-top: 40px; padding-top: 16px; border-top: 1px solid #e5e7eb; text-align: center; font-size: 12px; color: #9ca3af;">
+    Designed and developed by
+    <strong><a href="https://www.linkedin.com/in/shankonduru/" target="_blank" rel="noopener noreferrer" style="color: #0a66c2; text-decoration: none;">Shan Konduru</a></strong>
+    &nbsp;|&nbsp;
+    <a href="https://www.linkedin.com/in/shankonduru/" target="_blank" rel="noopener noreferrer" style="color: #0a66c2; text-decoration: none;">LinkedIn</a>
+    &nbsp;&bull;&nbsp;
+    <a href="https://github.com/ShanKonduru" target="_blank" rel="noopener noreferrer" style="color: #1f2937; text-decoration: none;">GitHub</a>
+  </footer>
+</body>
+</html>
+"""

sec_report_kit/services/__init__.py

@@ -0,0 +1 @@
+"""Normalization and summarization services."""

sec_report_kit/services/normalize.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+SEVERITY_ORDER = {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "UNKNOWN": 4,
+}
+
+
+def normalize_severity(value: str | None) -> str:
+    if not value:
+        return "UNKNOWN"
+    upper = value.upper()
+    return upper if upper in SEVERITY_ORDER else "UNKNOWN"

sec_report_kit/services/summarize.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import SEVERITY_ORDER
+
+
+def sort_findings(findings: Iterable[Finding]) -> list[Finding]:
+    return sorted(
+        findings,
+        key=lambda item: (
+            SEVERITY_ORDER[item.severity],
+            item.package.lower(),
+            item.vulnerability_id.lower(),
+        ),
+    )
+
+
+def count_by_severity(findings: Iterable[Finding]) -> dict[str, int]:
+    counts = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}
+    for finding in findings:
+        counts[finding.severity] += 1
+    return counts

sec_report_kit-0.1.2.dist-info/METADATA

@@ -0,0 +1,204 @@
+Metadata-Version: 2.4
+Name: sec-report-kit
+Version: 0.1.2
+Summary: Generate HTML security reports from Trivy and pip-audit JSON
+Author: Ravi Konduru
+License: MIT
+Keywords: cli,mcp,pip-audit,report,security,trivy
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: typer>=0.12.0
+Provides-Extra: dev
+Requires-Dist: build>=1.2.0; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Requires-Dist: twine>=5.0.0; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# sec-report-kit
+
+Generate HTML vulnerability reports from Trivy and pip-audit JSON with a CLI and MCP server.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+With MCP support:
+
+```bash
+pip install -e .[mcp]
+```
+
+## CLI Usage
+
+Both commands are available:
+
+- `srk`
+- `sec-report-kit`
+
+Render Trivy JSON:
+
+```bash
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --target shankonduru/cpkc-poc:v1.0.21
+```
+
+Render pip-audit JSON:
+
+```bash
+srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
+```
+
+## MCP Server
+
+Run MCP server over stdio:
+
+```bash
+srk mcp serve --transport stdio
+```
+
+### Available MCP Tools
+
+| Tool | Description |
+|---|---|
+| `summarize_json` | Summarize vulnerabilities by severity from a JSON file |
+| `render_report_from_json` | Parse JSON and render an HTML report to disk |
+| `validate_input` | Validate that a JSON file is parseable and return finding count |
+
+All tools accept `source_type` (`"trivy"` or `"pip-audit"`) and `input_path` (absolute path to JSON file).
+
+---
+
+### VS Code (GitHub Copilot Agent / MCP extension)
+
+Add to your VS Code `settings.json` (or `.vscode/mcp.json` in the workspace):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "sec-report-kit": {
+        "type": "stdio",
+        "command": "srk",
+        "args": ["mcp", "serve", "--transport", "stdio"]
+      }
+    }
+  }
+}
+```
+
+> **Note:** If `srk` is not on the system PATH, replace `"command"` with the full path to the executable, e.g. `"C:/Users/you/.venv/Scripts/srk.exe"`.
+
+---
+
+### Claude Desktop
+
+Edit `%APPDATA%\Claude\claude_desktop_config.json` (Windows) or `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Cursor
+
+Open **Cursor Settings → MCP** and add a new server entry:
+
+```json
+{
+  "sec-report-kit": {
+    "command": "srk",
+    "args": ["mcp", "serve", "--transport", "stdio"]
+  }
+}
+```
+
+Or add it to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Windsurf (Codeium)
+
+Edit `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Using a virtual environment
+
+If the package is installed in a `.venv`, use the full path to avoid PATH issues:
+
+**Windows:**
+```json
+{
+  "command": "C:/MyProjects/sec-report-kit/.venv/Scripts/srk.exe",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+**macOS / Linux:**
+```json
+{
+  "command": "/home/user/sec-report-kit/.venv/bin/srk",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+## Package Publish
+
+Build:
+
+```bash
+python -m build
+```
+
+Upload to TestPyPI:
+
+```bash
+python -m twine upload --repository testpypi dist/*
+```
+
+Upload to PyPI:
+
+```bash
+python -m twine upload dist/*
+```

sec_report_kit-0.1.2.dist-info/RECORD

@@ -0,0 +1,18 @@
+sec_report_kit/__init__.py,sha256=butvkt3RGg7a4NtMzx2wVfE2zTZ9NCMRso8hy2KjKrc,79
+sec_report_kit/__main__.py,sha256=CNS9ncbqlLuigWe5YRQwvWy2pfhF00MaxMcgcGBBpz4,76
+sec_report_kit/cli.py,sha256=EdKhx5IGg9zQUjPyHxftTY8h5fYUwxrNfq5wqAxDrhA,3524
+sec_report_kit/models.py,sha256=v0okbfQyLv9ywZ3Gi2pFi4RYbIWcy2sNs8dLknjN_i4,295
+sec_report_kit/mcp/__init__.py,sha256=xTYXpAoPsb-41eqtt7rvl-tcTSXIG9s9-3gp4pe_WL8,30
+sec_report_kit/mcp/server.py,sha256=aqEELFVtdigJjJfXtbemuG17XPunE-L_ZQ-VqN42kVM,2459
+sec_report_kit/parsers/__init__.py,sha256=lLUe3gagaQ0N4fU_wB7J0scGD2YSyTB9kihZMLzfN2c,625
+sec_report_kit/parsers/pip_audit.py,sha256=bswVv83q957aNsC2vR-iqw4N5EnIdq4iGzcTGPlvrfs,2504
+sec_report_kit/parsers/trivy.py,sha256=43G3pSDEa-xLJL8m6jo1q4s01Jwd_uBtPZDqzZGfrCc,1070
+sec_report_kit/report/__init__.py,sha256=bmQ3dGBiHqSPwumamEebbTyZSdWgUDms_jPjo1MBB0Y,24
+sec_report_kit/report/html_renderer.py,sha256=FTxEKFfPYB-qxIsK4ZAlnZ3TxBbTf67ucOjt2WURgpk,8348
+sec_report_kit/services/__init__.py,sha256=4eRbOiuQROzQwRWauSbyfaZ6y9sstmw7j0rSzxB49Jk,48
+sec_report_kit/services/normalize.py,sha256=jG1yG8eNueu2oEd5vqgU25guCS-y4Bf5TI6-EFt5l1w,320
+sec_report_kit/services/summarize.py,sha256=N5U7qwzkLXtfMG4_J-BXr-2X8vYGo1ynZfuqwXCvSUQ,679
+sec_report_kit-0.1.2.dist-info/METADATA,sha256=kAriVYobqZHbM-y0KpC53gZe1fFUDAAD-TPoacNZ8v0,4119
+sec_report_kit-0.1.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sec_report_kit-0.1.2.dist-info/entry_points.txt,sha256=FfuWDFya9VntP5bB6KOgXOKg6RvJQ0wo1CzvZBgfJsY,89
+sec_report_kit-0.1.2.dist-info/RECORD,,

sec_report_kit-0.1.2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

sec_report_kit-0.1.2.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+sec-report-kit = sec_report_kit.cli:main
+srk = sec_report_kit.cli:main