sec-report-kit 0.1.2__tar.gz

sec_report_kit-0.1.2/.github/workflows/publish-pypi.yml

@@ -0,0 +1,89 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-version:
+    name: Verify tag matches package version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Extract package version from pyproject.toml
+        id: pkg_version
+        run: |
+          VERSION=$(python -c "
+          import tomllib
+          with open('pyproject.toml', 'rb') as f:
+              data = tomllib.load(f)
+          print(data['project']['version'])
+          ")
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Check tag matches package version
+        run: |
+          TAG="${GITHUB_REF_NAME}"          # e.g. v0.1.0
+          PKG="v${{ steps.pkg_version.outputs.version }}"   # e.g. v0.1.0
+          echo "Git tag : $TAG"
+          echo "Package : $PKG"
+          if [ "$TAG" != "$PKG" ]; then
+            echo "ERROR: git tag '$TAG' does not match package version '$PKG'"
+            exit 1
+          fi
+
+  test:
+    name: Run tests
+    needs: verify-version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dev dependencies
+        run: pip install -e ".[mcp,dev]"
+
+      - name: Run tests
+        run: pytest
+
+  publish-pypi:
+    name: Build & publish to PyPI
+    needs: test
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

sec_report_kit-0.1.2/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,57 @@
+name: Publish to TestPyPI
+
+on:
+  push:
+    branches:
+      - "**"
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dev dependencies
+        run: pip install -e ".[mcp,dev]"
+
+      - name: Run tests
+        run: pytest
+
+  publish-testpypi:
+    name: Build & publish to TestPyPI
+    needs: test
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.REPO_ACCESS_TOKEN || github.token }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true

sec_report_kit-0.1.2/.gitignore

@@ -0,0 +1,85 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.pytest_cache/
+
+# Type checkers / analyzers
+.mypy_cache/
+.dmypy.json
+dmypy.json
+.pyre/
+.pytype/
+.ruff_cache/
+
+# Environments
+.env
+.env.*
+!.env.sample
+.venv/
+venv/
+env/
+ENV/
+env.bak/
+venv.bak/
+
+# Notebook artifacts
+.ipynb_checkpoints/
+
+# IDE / editor
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Project-local runtime data
+data/
+logs/
+security_reports/

sec_report_kit-0.1.2/PKG-INFO

@@ -0,0 +1,204 @@
+Metadata-Version: 2.4
+Name: sec-report-kit
+Version: 0.1.2
+Summary: Generate HTML security reports from Trivy and pip-audit JSON
+Author: Ravi Konduru
+License: MIT
+Keywords: cli,mcp,pip-audit,report,security,trivy
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: typer>=0.12.0
+Provides-Extra: dev
+Requires-Dist: build>=1.2.0; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Requires-Dist: twine>=5.0.0; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# sec-report-kit
+
+Generate HTML vulnerability reports from Trivy and pip-audit JSON with a CLI and MCP server.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+With MCP support:
+
+```bash
+pip install -e .[mcp]
+```
+
+## CLI Usage
+
+Both commands are available:
+
+- `srk`
+- `sec-report-kit`
+
+Render Trivy JSON:
+
+```bash
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --target shankonduru/cpkc-poc:v1.0.21
+```
+
+Render pip-audit JSON:
+
+```bash
+srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
+```
+
+## MCP Server
+
+Run MCP server over stdio:
+
+```bash
+srk mcp serve --transport stdio
+```
+
+### Available MCP Tools
+
+| Tool | Description |
+|---|---|
+| `summarize_json` | Summarize vulnerabilities by severity from a JSON file |
+| `render_report_from_json` | Parse JSON and render an HTML report to disk |
+| `validate_input` | Validate that a JSON file is parseable and return finding count |
+
+All tools accept `source_type` (`"trivy"` or `"pip-audit"`) and `input_path` (absolute path to JSON file).
+
+---
+
+### VS Code (GitHub Copilot Agent / MCP extension)
+
+Add to your VS Code `settings.json` (or `.vscode/mcp.json` in the workspace):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "sec-report-kit": {
+        "type": "stdio",
+        "command": "srk",
+        "args": ["mcp", "serve", "--transport", "stdio"]
+      }
+    }
+  }
+}
+```
+
+> **Note:** If `srk` is not on the system PATH, replace `"command"` with the full path to the executable, e.g. `"C:/Users/you/.venv/Scripts/srk.exe"`.
+
+---
+
+### Claude Desktop
+
+Edit `%APPDATA%\Claude\claude_desktop_config.json` (Windows) or `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Cursor
+
+Open **Cursor Settings → MCP** and add a new server entry:
+
+```json
+{
+  "sec-report-kit": {
+    "command": "srk",
+    "args": ["mcp", "serve", "--transport", "stdio"]
+  }
+}
+```
+
+Or add it to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Windsurf (Codeium)
+
+Edit `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Using a virtual environment
+
+If the package is installed in a `.venv`, use the full path to avoid PATH issues:
+
+**Windows:**
+```json
+{
+  "command": "C:/MyProjects/sec-report-kit/.venv/Scripts/srk.exe",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+**macOS / Linux:**
+```json
+{
+  "command": "/home/user/sec-report-kit/.venv/bin/srk",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+## Package Publish
+
+Build:
+
+```bash
+python -m build
+```
+
+Upload to TestPyPI:
+
+```bash
+python -m twine upload --repository testpypi dist/*
+```
+
+Upload to PyPI:
+
+```bash
+python -m twine upload dist/*
+```

sec_report_kit-0.1.2/README.md

@@ -0,0 +1,178 @@
+# sec-report-kit
+
+Generate HTML vulnerability reports from Trivy and pip-audit JSON with a CLI and MCP server.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+With MCP support:
+
+```bash
+pip install -e .[mcp]
+```
+
+## CLI Usage
+
+Both commands are available:
+
+- `srk`
+- `sec-report-kit`
+
+Render Trivy JSON:
+
+```bash
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/report-trivy.html --target shankonduru/cpkc-poc:v1.0.21
+```
+
+Render pip-audit JSON:
+
+```bash
+srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
+```
+
+## MCP Server
+
+Run MCP server over stdio:
+
+```bash
+srk mcp serve --transport stdio
+```
+
+### Available MCP Tools
+
+| Tool | Description |
+|---|---|
+| `summarize_json` | Summarize vulnerabilities by severity from a JSON file |
+| `render_report_from_json` | Parse JSON and render an HTML report to disk |
+| `validate_input` | Validate that a JSON file is parseable and return finding count |
+
+All tools accept `source_type` (`"trivy"` or `"pip-audit"`) and `input_path` (absolute path to JSON file).
+
+---
+
+### VS Code (GitHub Copilot Agent / MCP extension)
+
+Add to your VS Code `settings.json` (or `.vscode/mcp.json` in the workspace):
+
+```json
+{
+  "mcp": {
+    "servers": {
+      "sec-report-kit": {
+        "type": "stdio",
+        "command": "srk",
+        "args": ["mcp", "serve", "--transport", "stdio"]
+      }
+    }
+  }
+}
+```
+
+> **Note:** If `srk` is not on the system PATH, replace `"command"` with the full path to the executable, e.g. `"C:/Users/you/.venv/Scripts/srk.exe"`.
+
+---
+
+### Claude Desktop
+
+Edit `%APPDATA%\Claude\claude_desktop_config.json` (Windows) or `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Cursor
+
+Open **Cursor Settings → MCP** and add a new server entry:
+
+```json
+{
+  "sec-report-kit": {
+    "command": "srk",
+    "args": ["mcp", "serve", "--transport", "stdio"]
+  }
+}
+```
+
+Or add it to `.cursor/mcp.json` in your project root:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Windsurf (Codeium)
+
+Edit `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "sec-report-kit": {
+      "command": "srk",
+      "args": ["mcp", "serve", "--transport", "stdio"]
+    }
+  }
+}
+```
+
+---
+
+### Using a virtual environment
+
+If the package is installed in a `.venv`, use the full path to avoid PATH issues:
+
+**Windows:**
+```json
+{
+  "command": "C:/MyProjects/sec-report-kit/.venv/Scripts/srk.exe",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+**macOS / Linux:**
+```json
+{
+  "command": "/home/user/sec-report-kit/.venv/bin/srk",
+  "args": ["mcp", "serve", "--transport", "stdio"]
+}
+```
+
+## Package Publish
+
+Build:
+
+```bash
+python -m build
+```
+
+Upload to TestPyPI:
+
+```bash
+python -m twine upload --repository testpypi dist/*
+```
+
+Upload to PyPI:
+
+```bash
+python -m twine upload dist/*
+```

sec_report_kit-0.1.2/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling>=1.25.0"]
+build-backend = "hatchling.build"
+
+[project]
+name = "sec-report-kit"
+version = "0.1.2"
+description = "Generate HTML security reports from Trivy and pip-audit JSON"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Ravi Konduru" }]
+keywords = ["security", "trivy", "pip-audit", "mcp", "cli", "report"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Security",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+  "typer>=0.12.0",
+]
+
+[project.optional-dependencies]
+mcp = [
+  "mcp>=1.0.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "twine>=5.0.0",
+]
+
+[project.scripts]
+srk = "sec_report_kit.cli:main"
+"sec-report-kit" = "sec_report_kit.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/sec_report_kit"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

sec_report_kit-0.1.2/src/sec_report_kit/__init__.py

@@ -0,0 +1,4 @@
+"""sec_report_kit package."""
+
+__all__ = ["__version__"]
+__version__ = "0.1.0"

sec_report_kit-0.1.2/src/sec_report_kit/__main__.py

@@ -0,0 +1,5 @@
+from sec_report_kit.cli import main
+
+
+if __name__ == "__main__":
+    main()

sec_report_kit-0.1.2/src/sec_report_kit/cli.py

@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from sec_report_kit.parsers import detect_source_type
+from sec_report_kit.parsers.pip_audit import parse_pip_audit_json
+from sec_report_kit.parsers.trivy import parse_trivy_json
+from sec_report_kit.report.html_renderer import render_html_report
+from sec_report_kit.services.summarize import count_by_severity, sort_findings
+
+app = typer.Typer(help="Security report kit CLI")
+render_app = typer.Typer(help="Render HTML reports")
+mcp_app = typer.Typer(help="MCP server commands")
+app.add_typer(render_app, name="render")
+app.add_typer(mcp_app, name="mcp")
+
+
+def _load_json(path: Path) -> dict:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def _write_report(source_label: str, target_ref: str, input_path: Path, output_path: Path, parser: str) -> None:
+    payload = _load_json(input_path)
+    if parser == "auto":
+        parser = detect_source_type(payload)
+        typer.echo(f"[INFO] Detected source type: {parser}")
+    if parser == "trivy":
+        findings = parse_trivy_json(payload)
+    elif parser == "pip-audit":
+        findings = parse_pip_audit_json(payload)
+    else:
+        raise typer.BadParameter(f"Unsupported parser: {parser}")
+
+    findings = sort_findings(findings)
+    counts = count_by_severity(findings)
+    report_html = render_html_report(target_ref=target_ref, source_label=source_label, findings=findings, counts=counts)
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_text(report_html, encoding="utf-8")
+
+    typer.echo(f"[OK] Report generated: {output_path}")
+    typer.echo(f"[INFO] Total findings: {len(findings)}")
+    typer.echo(f"[INFO] Severity counts: {counts}")
+
+
+@render_app.command("trivy")
+def render_trivy(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option(..., "--target", help="Scanned image or artifact reference"),
+) -> None:
+    """Render HTML report from Trivy JSON output."""
+    _write_report("trivy", target, input, output, parser="trivy")
+
+
+@render_app.command("pip-audit")
+def render_pip_audit(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option("python-environment", "--target", help="Python environment target label"),
+) -> None:
+    """Render HTML report from pip-audit JSON output."""
+    _write_report("pip-audit", target, input, output, parser="pip-audit")
+
+
+@render_app.command("auto")
+def render_auto(
+    input: Path = typer.Option(..., "--input", exists=True, dir_okay=False, file_okay=True, readable=True),
+    output: Path = typer.Option(..., "--output", dir_okay=False, file_okay=True),
+    target: str = typer.Option("unknown", "--target", help="Scanned image or artifact reference"),
+) -> None:
+    """Auto-detect input format (Trivy or pip-audit) and render HTML report."""
+    _write_report("auto", target, input, output, parser="auto")
+
+
+@mcp_app.command("serve")
+def serve_mcp(
+    transport: str = typer.Option("stdio", "--transport", help="MCP transport (currently stdio)")
+) -> None:
+    """Run the MCP server."""
+    from sec_report_kit.mcp.server import run_server
+
+    run_server(transport=transport)
+
+
+def main() -> None:
+    app()
+
+
+if __name__ == "__main__":
+    main()

sec_report_kit-0.1.2/src/sec_report_kit/mcp/__init__.py

@@ -0,0 +1 @@
+"""MCP server integration."""

sec_report_kit-0.1.2/src/sec_report_kit/mcp/server.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from sec_report_kit.parsers import detect_source_type
+from sec_report_kit.parsers.pip_audit import parse_pip_audit_json
+from sec_report_kit.parsers.trivy import parse_trivy_json
+from sec_report_kit.report.html_renderer import render_html_report
+from sec_report_kit.services.summarize import count_by_severity, sort_findings
+
+
+def _load_payload(source_type: str, input_path: str):
+    data = json.loads(Path(input_path).read_text(encoding="utf-8"))
+    if source_type == "auto":
+        source_type = detect_source_type(data)
+    if source_type == "trivy":
+        return sort_findings(parse_trivy_json(data))
+    if source_type == "pip-audit":
+        return sort_findings(parse_pip_audit_json(data))
+    raise ValueError("source_type must be 'trivy', 'pip-audit', or 'auto'")
+
+
+def build_server():
+    try:
+        from mcp.server.fastmcp import FastMCP
+    except Exception as exc:  # pragma: no cover
+        raise RuntimeError(
+            "MCP dependencies are not installed. Install with: pip install sec-report-kit[mcp]"
+        ) from exc
+
+    mcp = FastMCP("sec-report-kit")
+
+    @mcp.tool()
+    def summarize_json(source_type: str, input_path: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        counts = count_by_severity(findings)
+        return {"total": len(findings), "counts": counts}
+
+    @mcp.tool()
+    def render_report_from_json(source_type: str, input_path: str, output_path: str, target: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        counts = count_by_severity(findings)
+        html = render_html_report(target_ref=target, source_label=source_type, findings=findings, counts=counts)
+        out = Path(output_path)
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(html, encoding="utf-8")
+        return {"output_path": str(out), "total": len(findings), "counts": counts}
+
+    @mcp.tool()
+    def validate_input(source_type: str, input_path: str) -> dict:
+        findings = _load_payload(source_type=source_type, input_path=input_path)
+        return {"valid": True, "total_findings": len(findings)}
+
+    return mcp
+
+
+def run_server(transport: str = "stdio") -> None:
+    mcp = build_server()
+    if transport != "stdio":
+        raise ValueError("Only stdio transport is currently supported")
+    mcp.run(transport="stdio")

sec_report_kit-0.1.2/src/sec_report_kit/models.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class Finding:
+    source_type: str
+    target: str
+    severity: str
+    vulnerability_id: str
+    package: str
+    installed_version: str
+    fixed_version: str
+    title: str
+    primary_url: str

sec_report_kit-0.1.2/src/sec_report_kit/parsers/__init__.py

@@ -0,0 +1,18 @@
+"""Input format parsers."""
+
+
+def detect_source_type(data: dict) -> str:
+    """Detect whether *data* came from Trivy or pip-audit.
+
+    Returns ``"trivy"`` or ``"pip-audit"``.
+    Raises ``ValueError`` if the format cannot be recognised.
+    """
+    if isinstance(data, dict):
+        if "Results" in data:
+            return "trivy"
+        if "dependencies" in data or "vulnerabilities" in data:
+            return "pip-audit"
+    raise ValueError(
+        "Cannot detect source type: JSON does not match any known format "
+        "(expected 'Results' for Trivy or 'dependencies'/'vulnerabilities' for pip-audit)."
+    )

sec_report_kit-0.1.2/src/sec_report_kit/parsers/pip_audit.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import normalize_severity
+
+
+def _best_url(vuln: dict) -> str:
+    if vuln.get("url"):
+        return str(vuln["url"])
+    if vuln.get("advisory"):
+        return str(vuln["advisory"])
+    if vuln.get("links") and isinstance(vuln["links"], list):
+        return str(vuln["links"][0]) if vuln["links"] else ""
+    return ""
+
+
+def _fixed_version(vuln: dict) -> str:
+    fixes = vuln.get("fix_versions")
+    if isinstance(fixes, list) and fixes:
+        return ", ".join(str(value) for value in fixes)
+    fixed = vuln.get("fixed_version")
+    return str(fixed) if fixed else "-"
+
+
+def parse_pip_audit_json(data: dict) -> list[Finding]:
+    findings: list[Finding] = []
+
+    dependencies = data.get("dependencies", []) if isinstance(data, dict) else []
+    for dep in dependencies:
+        package = dep.get("name", "-")
+        installed = dep.get("version", "-")
+        for vuln in dep.get("vulns", []) or []:
+            findings.append(
+                Finding(
+                    source_type="python-pkg",
+                    target="Python",
+                    severity=normalize_severity(vuln.get("severity")),
+                    vulnerability_id=str(vuln.get("id") or "-"),
+                    package=str(package),
+                    installed_version=str(installed),
+                    fixed_version=_fixed_version(vuln),
+                    title=str(vuln.get("description") or vuln.get("summary") or "-"),
+                    primary_url=_best_url(vuln),
+                )
+            )
+
+    # Some tools may output a flat list under "vulnerabilities"; support that too.
+    if not findings and isinstance(data, dict) and isinstance(data.get("vulnerabilities"), list):
+        for vuln in data["vulnerabilities"]:
+            findings.append(
+                Finding(
+                    source_type="python-pkg",
+                    target="Python",
+                    severity=normalize_severity(vuln.get("severity")),
+                    vulnerability_id=str(vuln.get("id") or "-"),
+                    package=str(vuln.get("package") or "-"),
+                    installed_version=str(vuln.get("installed_version") or "-"),
+                    fixed_version=_fixed_version(vuln),
+                    title=str(vuln.get("description") or vuln.get("summary") or "-"),
+                    primary_url=_best_url(vuln),
+                )
+            )
+
+    return findings

sec_report_kit-0.1.2/src/sec_report_kit/parsers/trivy.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import normalize_severity
+
+
+def parse_trivy_json(data: dict) -> list[Finding]:
+    findings: list[Finding] = []
+    for result in data.get("Results", []):
+        target = result.get("Target", "unknown")
+        source_type = result.get("Type", "unknown")
+        for vuln in result.get("Vulnerabilities", []) or []:
+            findings.append(
+                Finding(
+                    source_type=source_type,
+                    target=target,
+                    severity=normalize_severity(vuln.get("Severity")),
+                    vulnerability_id=vuln.get("VulnerabilityID", "-"),
+                    package=vuln.get("PkgName", "-"),
+                    installed_version=vuln.get("InstalledVersion", "-"),
+                    fixed_version=vuln.get("FixedVersion") or "-",
+                    title=vuln.get("Title") or "-",
+                    primary_url=vuln.get("PrimaryURL") or "",
+                )
+            )
+    return findings

sec_report_kit-0.1.2/src/sec_report_kit/report/__init__.py

@@ -0,0 +1 @@
+"""Report renderers."""

sec_report_kit-0.1.2/src/sec_report_kit/report/html_renderer.py

@@ -0,0 +1,206 @@
+from __future__ import annotations
+
+import datetime as dt
+import html
+
+from sec_report_kit.models import Finding
+
+
+def _esc(value: str) -> str:
+    return html.escape(value, quote=True)
+
+
+def render_html_report(target_ref: str, source_label: str, findings: list[Finding], counts: dict[str, int]) -> str:
+    generated_at = dt.datetime.now(dt.timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
+    total = len(findings)
+
+    rows = []
+    for item in findings:
+        vuln_id = _esc(item.vulnerability_id)
+        if item.primary_url:
+            vuln_cell = (
+                f'<a href="{_esc(item.primary_url)}" target="_blank" rel="noopener noreferrer">{vuln_id}</a>'
+            )
+        else:
+            vuln_cell = vuln_id
+
+        rows.append(
+            "<tr>"
+            f"<td class=\"sev {_esc(item.severity).lower()}\">{_esc(item.severity)}</td>"
+            f"<td>{vuln_cell}</td>"
+            f"<td>{_esc(item.package)}</td>"
+            f"<td>{_esc(item.installed_version)}</td>"
+            f"<td>{_esc(item.fixed_version)}</td>"
+            f"<td>{_esc(item.title)}</td>"
+            f"<td>{_esc(item.target)}</td>"
+            f"<td>{_esc(item.source_type)}</td>"
+            "</tr>"
+        )
+
+    rows_html = "\n".join(rows) if rows else "<tr><td colspan=\"8\">No vulnerabilities found.</td></tr>"
+
+    return f"""<!doctype html>
+<html lang=\"en\">
+<head>
+  <meta charset=\"utf-8\" />
+  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />
+  <title>Security Report</title>
+  <style>
+    body {{ font-family: Segoe UI, Arial, sans-serif; margin: 24px; color: #1f2937; }}
+    h1 {{ margin: 0 0 8px 0; }}
+    .meta {{ margin-bottom: 18px; color: #4b5563; }}
+    .cards {{ display: grid; grid-template-columns: repeat(6, minmax(110px, 1fr)); gap: 10px; margin-bottom: 18px; }}
+    .card {{ border: 1px solid #d1d5db; border-radius: 8px; padding: 10px 12px; background: #f9fafb; }}
+    .label {{ font-size: 12px; color: #6b7280; text-transform: uppercase; }}
+    .value {{ font-size: 24px; font-weight: 700; margin-top: 4px; }}
+    .filters {{ display: flex; flex-wrap: wrap; gap: 10px; margin-bottom: 14px; align-items: center; }}
+    .filters label {{ font-size: 13px; color: #374151; display: flex; flex-direction: column; gap: 3px; }}
+    .filters select, .filters input[type=text] {{
+      font-size: 13px; padding: 5px 8px; border: 1px solid #d1d5db;
+      border-radius: 6px; background: #fff; color: #1f2937; min-width: 140px;
+    }}
+    .filters input[type=text] {{ min-width: 220px; }}
+    .filters button {{
+      font-size: 13px; padding: 6px 14px; border: 1px solid #d1d5db;
+      border-radius: 6px; background: #f3f4f6; cursor: pointer; color: #374151;
+      align-self: flex-end;
+    }}
+    .filters button:hover {{ background: #e5e7eb; }}
+    #result-count {{ font-size: 13px; color: #6b7280; align-self: flex-end; margin-left: auto; }}
+    table {{ width: 100%; border-collapse: collapse; font-size: 13px; }}
+    thead th {{ text-align: left; border-bottom: 2px solid #d1d5db; padding: 8px; background: #f3f4f6; position: sticky; top: 0; }}
+    tbody td {{ border-bottom: 1px solid #e5e7eb; padding: 8px; vertical-align: top; }}
+    tbody tr.hidden {{ display: none; }}
+    .sev {{ font-weight: 700; }}
+    .critical {{ color: #b91c1c; }}
+    .high {{ color: #c2410c; }}
+    .medium {{ color: #b45309; }}
+    .low {{ color: #1d4ed8; }}
+    .unknown {{ color: #6b7280; }}
+    a {{ color: #1d4ed8; text-decoration: none; }}
+    a:hover {{ text-decoration: underline; }}
+  </style>
+</head>
+<body>
+  <h1>Security Vulnerability Report</h1>
+  <div class=\"meta\">Source: <strong>{_esc(source_label)}</strong> | Target: <strong>{_esc(target_ref)}</strong> | Generated: {_esc(generated_at)}</div>
+
+  <div class=\"cards\">
+    <div class=\"card\"><div class=\"label\">Total</div><div class=\"value\">{total}</div></div>
+    <div class=\"card\"><div class=\"label\">Critical</div><div class=\"value critical\">{counts['CRITICAL']}</div></div>
+    <div class=\"card\"><div class=\"label\">High</div><div class=\"value high\">{counts['HIGH']}</div></div>
+    <div class=\"card\"><div class=\"label\">Medium</div><div class=\"value medium\">{counts['MEDIUM']}</div></div>
+    <div class=\"card\"><div class=\"label\">Low</div><div class=\"value low\">{counts['LOW']}</div></div>
+    <div class=\"card\"><div class=\"label\">Unknown</div><div class=\"value unknown\">{counts['UNKNOWN']}</div></div>
+  </div>
+
+  <div class=\"filters\">
+    <label>Severity
+      <select id=\"f-severity\">
+        <option value=\"\">All</option>
+        <option value=\"critical\">Critical</option>
+        <option value=\"high\">High</option>
+        <option value=\"medium\">Medium</option>
+        <option value=\"low\">Low</option>
+        <option value=\"unknown\">Unknown</option>
+      </select>
+    </label>
+    <label>Vulnerability ID
+      <input type=\"text\" id=\"f-vuln\" placeholder=\"e.g. CVE-2024-\" />
+    </label>
+    <label>Package
+      <input type=\"text\" id=\"f-pkg\" placeholder=\"e.g. openssl\" />
+    </label>
+    <label>Target
+      <input type=\"text\" id=\"f-target\" placeholder=\"e.g. usr/lib\" />
+    </label>
+    <label>Type
+      <input type=\"text\" id=\"f-type\" placeholder=\"e.g. os-pkgs\" />
+    </label>
+    <label>Title / keyword
+      <input type=\"text\" id=\"f-title\" placeholder=\"e.g. buffer overflow\" />
+    </label>
+    <button onclick=\"clearFilters()\">Clear</button>
+    <span id=\"result-count\"></span>
+  </div>
+
+  <table id=\"vuln-table\">
+    <thead>
+      <tr>
+        <th>Severity</th>
+        <th>Vulnerability</th>
+        <th>Package</th>
+        <th>Installed</th>
+        <th>Fixed</th>
+        <th>Title</th>
+        <th>Target</th>
+        <th>Type</th>
+      </tr>
+    </thead>
+    <tbody id=\"vuln-body\">
+      {rows_html}
+    </tbody>
+  </table>
+
+  <script>
+    const filterIds = ['f-severity', 'f-vuln', 'f-pkg', 'f-target', 'f-type', 'f-title'];
+    // col indices: severity=0, vuln=1, pkg=2, installed=3, fixed=4, title=5, target=6, type=7
+    const colMap = {{ 'f-severity': 0, 'f-vuln': 1, 'f-pkg': 2, 'f-target': 6, 'f-type': 7, 'f-title': 5 }};
+
+    function applyFilters() {{
+      const filters = {{}};
+      filterIds.forEach(id => {{
+        const el = document.getElementById(id);
+        filters[id] = el.value.trim().toLowerCase();
+      }});
+
+      const rows = document.querySelectorAll('#vuln-body tr');
+      let visible = 0;
+      rows.forEach(row => {{
+        const cells = row.querySelectorAll('td');
+        if (!cells.length) return;
+        let show = true;
+        for (const [id, col] of Object.entries(colMap)) {{
+          const val = filters[id];
+          if (!val) continue;
+          const cellText = (cells[col]?.textContent || '').trim().toLowerCase();
+          if (id === 'f-severity') {{
+            if (cellText !== val) {{ show = false; break; }}
+          }} else {{
+            if (!cellText.includes(val)) {{ show = false; break; }}
+          }}
+        }}
+        row.classList.toggle('hidden', !show);
+        if (show) visible++;
+      }});
+
+      const total = rows.length;
+      document.getElementById('result-count').textContent =
+        visible === total ? `${{total}} rows` : `${{visible}} of ${{total}} rows`;
+    }}
+
+    function clearFilters() {{
+      filterIds.forEach(id => {{ document.getElementById(id).value = ''; }});
+      applyFilters();
+    }}
+
+    filterIds.forEach(id => {{
+      const el = document.getElementById(id);
+      el.addEventListener('input', applyFilters);
+      el.addEventListener('change', applyFilters);
+    }});
+
+    applyFilters();
+  </script>
+
+  <footer style="margin-top: 40px; padding-top: 16px; border-top: 1px solid #e5e7eb; text-align: center; font-size: 12px; color: #9ca3af;">
+    Designed and developed by
+    <strong><a href="https://www.linkedin.com/in/shankonduru/" target="_blank" rel="noopener noreferrer" style="color: #0a66c2; text-decoration: none;">Shan Konduru</a></strong>
+    &nbsp;|&nbsp;
+    <a href="https://www.linkedin.com/in/shankonduru/" target="_blank" rel="noopener noreferrer" style="color: #0a66c2; text-decoration: none;">LinkedIn</a>
+    &nbsp;&bull;&nbsp;
+    <a href="https://github.com/ShanKonduru" target="_blank" rel="noopener noreferrer" style="color: #1f2937; text-decoration: none;">GitHub</a>
+  </footer>
+</body>
+</html>
+"""

sec_report_kit-0.1.2/src/sec_report_kit/services/__init__.py

@@ -0,0 +1 @@
+"""Normalization and summarization services."""

sec_report_kit-0.1.2/src/sec_report_kit/services/normalize.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+SEVERITY_ORDER = {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "UNKNOWN": 4,
+}
+
+
+def normalize_severity(value: str | None) -> str:
+    if not value:
+        return "UNKNOWN"
+    upper = value.upper()
+    return upper if upper in SEVERITY_ORDER else "UNKNOWN"

sec_report_kit-0.1.2/src/sec_report_kit/services/summarize.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from sec_report_kit.models import Finding
+from sec_report_kit.services.normalize import SEVERITY_ORDER
+
+
+def sort_findings(findings: Iterable[Finding]) -> list[Finding]:
+    return sorted(
+        findings,
+        key=lambda item: (
+            SEVERITY_ORDER[item.severity],
+            item.package.lower(),
+            item.vulnerability_id.lower(),
+        ),
+    )
+
+
+def count_by_severity(findings: Iterable[Finding]) -> dict[str, int]:
+    counts = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}
+    for finding in findings:
+        counts[finding.severity] += 1
+    return counts

sec_report_kit-0.1.2/tests/test_parsers.py

@@ -0,0 +1,70 @@
+from sec_report_kit.parsers.pip_audit import parse_pip_audit_json
+from sec_report_kit.parsers.trivy import parse_trivy_json
+from sec_report_kit.services.summarize import count_by_severity
+
+
+def test_parse_trivy_json_basic():
+    payload = {
+        "Results": [
+            {
+                "Target": "myimage:1",
+                "Type": "debian",
+                "Vulnerabilities": [
+                    {
+                        "Severity": "HIGH",
+                        "VulnerabilityID": "CVE-1",
+                        "PkgName": "openssl",
+                        "InstalledVersion": "1.0",
+                        "FixedVersion": "1.1",
+                        "Title": "Example",
+                        "PrimaryURL": "https://example.com",
+                    }
+                ],
+            }
+        ]
+    }
+
+    findings = parse_trivy_json(payload)
+    assert len(findings) == 1
+    assert findings[0].severity == "HIGH"
+    assert findings[0].package == "openssl"
+
+
+def test_parse_pip_audit_json_basic():
+    payload = {
+        "dependencies": [
+            {
+                "name": "requests",
+                "version": "2.31.0",
+                "vulns": [
+                    {
+                        "id": "GHSA-xxxx",
+                        "fix_versions": ["2.32.0"],
+                        "description": "Example vuln",
+                        "url": "https://example.com/advisory",
+                    }
+                ],
+            }
+        ]
+    }
+
+    findings = parse_pip_audit_json(payload)
+    assert len(findings) == 1
+    assert findings[0].package == "requests"
+    assert findings[0].fixed_version == "2.32.0"
+
+
+def test_count_by_severity_unknown_when_missing():
+    payload = {
+        "dependencies": [
+            {
+                "name": "pkg",
+                "version": "1.0.0",
+                "vulns": [{"id": "PYSEC-1", "description": "no severity"}],
+            }
+        ]
+    }
+
+    findings = parse_pip_audit_json(payload)
+    counts = count_by_severity(findings)
+    assert counts["UNKNOWN"] == 1