sec-report-kit 0.2.1__tar.gz → 0.2.3__tar.gz

{sec_report_kit-0.2.1 → sec_report_kit-0.2.3}/.gitignore

@@ -36,6 +36,15 @@ pip-delete-this-directory.txt
 
 # Unit test / coverage reports
 htmlcov/
+class_index.html
+function_index.html
+index.html
+status.json
+coverage_html_*.js
+favicon_32_*.png
+keybd_closed_*.png
+style_*.css
+z_*.html
 .tox/
 .nox/
 .coverage

sec_report_kit-0.2.3/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 0.2.3 - 2026-05-13
+
+### Added
+- Safety CLI parser support and HTML rendering flow.
+- New CLI command: `srk render safety`.
+- MCP support for `source_type="safety"`.
+- Helper scripts for Safety scan and render:
+  - `scripts/run_safety.sh`
+  - `scripts/run_safety.bat`
+  - `scripts/render_safety_html.sh`
+  - `scripts/render_safety_html.bat`
+- Offline Safety DB download helpers:
+  - `scripts/download_safety_db.py`
+  - `scripts/download_safety_db.sh`
+  - `scripts/download_safety_db.bat`
+
+### Changed
+- Auto-detection now recognizes Safety JSON payloads.
+- Tool installation scripts now install Safety CLI in the app venv.
+- README updated with Safety usage and offline/local DB workflow guidance.
+
+### Fixed
+- Safety run scripts now avoid false success when network failures occur.
+- JSON output validation improved for Safety execution paths.

{sec_report_kit-0.2.1 → sec_report_kit-0.2.3}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.2.1
-Summary: Generate HTML security reports from Trivy, pip-audit, Bandit, and Gitleaks JSON
+Version: 0.2.3
+Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
-Keywords: cli,mcp,pip-audit,report,security,trivy
+Keywords: cli,mcp,pip-audit,report,safety,security,trivy
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -29,10 +29,13 @@ Description-Content-Type: text/markdown
 
 Generate HTML vulnerability reports from multiple security tools (SAST, SCA, IaC, and secrets) with a CLI and MCP server.
 
+Release history: see `CHANGELOG.md`.
+
 Supported source types:
 
 - `trivy`
 - `pip-audit`
+- `safety`
 - `bandit`
 - `gitleaks`
 - `semgrep`
@@ -73,10 +76,18 @@ Render pip-audit JSON:
 srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
 ```
 
+Render Safety JSON:
+
+```bash
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+```
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
 
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label.
+
 Install this package and Python-installable scanners:
 
 ```bash
@@ -87,7 +98,7 @@ bash scripts/install_tools.sh
 scripts\install_tools.bat
 ```
 
-After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and download required binaries. The `.tools/` folder is intentionally not committed to git.
+After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
 Run all unit tests locally with coverage:
 
@@ -113,6 +124,51 @@ scripts\run_pip_audit.bat
 scripts\run_pip_audit.bat reports requirements.txt
 ```
 
+Run Safety CLI and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <requirements_file>)
+bash scripts/run_safety.sh
+bash scripts/run_safety.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <requirements_file>)
+scripts\run_safety.bat
+scripts\run_safety.bat security_reports requirements.txt
+```
+
+> **Offline / local DB support**: Safety CLI requires network access by default. To enable offline scanning,
+> download the vulnerability DB while online and cache it locally:
+>
+> ```bash
+> # Linux/macOS — download once, reuse offline
+> bash scripts/download_safety_db.sh
+>
+> # Windows
+> scripts\download_safety_db.bat
+> ```
+>
+> ```bash
+> # Corporate/proxy environments with self-signed certificates
+> bash scripts/download_safety_db.sh .tools/safety-db --no-verify-ssl
+> scripts\download_safety_db.bat .tools\safety-db --no-verify-ssl
+> ```
+>
+> The DB is saved to `.tools/safety-db/`. Both `run_safety.sh` and `run_safety.bat` automatically detect
+> and use it on subsequent runs, skipping the network call. Re-run the download script periodically to
+> refresh the DB with the latest vulnerabilities.
+
+Run Bandit and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_path>)
+bash scripts/run_bandit.sh
+bash scripts/run_bandit.sh security_reports src
+
+# Windows (optional args: <report_dir> <target_path>)
+scripts\run_bandit.bat
+scripts\run_bandit.bat security_reports src
+```
+
 Convert pip-audit JSON report to HTML:
 
 ```bash
@@ -125,6 +181,18 @@ scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
 ```
 
+Convert Safety JSON report to HTML:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_safety_html.sh
+bash scripts/render_safety_html.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_safety_html.bat
+scripts\render_safety_html.bat security_reports requirements.txt
+```
+
 These render helpers generate the HTML file and open it automatically in your default browser.
 
 Convert sample Trivy JSON report to HTML:
@@ -167,37 +235,99 @@ By default, JSON is written to `reports/pip-audit.json` and HTML to `reports/pip
 
 ## Additional Tool Workflows
 
-Each workflow has paired run and render scripts in `scripts/`:
+### Script Coverage Matrix
 
-- Semgrep: `run_semgrep.(sh|bat)` and `render_semgrep_html.(sh|bat)`
-- CodeQL: `run_codeql.(sh|bat)` and `render_codeql_html.(sh|bat)`
-- OSV-Scanner: `run_osv_scanner.(sh|bat)` and `render_osv_scanner_html.(sh|bat)`
-- Checkov: `run_checkov.(sh|bat)` and `render_checkov_html.(sh|bat)`
-- tfsec: `run_tfsec.(sh|bat)` and `render_tfsec_html.(sh|bat)`
-- TruffleHog: `run_trufflehog.(sh|bat)` and `render_trufflehog_html.(sh|bat)`
+The table below reflects what is currently implemented in `scripts/`:
 
-Manual CLI render examples:
+| Tool | Run Script (JSON/SARIF) | Render Script (HTML) | Default JSON/SARIF Output |
+| --- | --- | --- | --- |
+| Trivy | `run_trivy.(sh/bat)` | `render_trivy_html.(sh/bat)` | `security_reports/trivy-image-report-v1.0.21.json` |
+| pip-audit | `run_pip_audit.(sh/bat)` | `render_pip_audit_html.(sh/bat)` | `reports/pip-audit.json` |
+| Safety | `run_safety.(sh/bat)` | `render_safety_html.(sh/bat)` | `security_reports/safety.json` |
+| Bandit | `run_bandit.(sh/bat)` | `render_bandit_html.(sh/bat)` | `security_reports/bandit.json` |
+| Gitleaks | `run_gitleaks.(sh/bat)` | `render_gitleaks_html.(sh/bat)` | `security_reports/gitleaks.json` |
+| Semgrep | `run_semgrep.(sh/bat)` | `render_semgrep_html.(sh/bat)` | `security_reports/semgrep.json` |
+| CodeQL | `run_codeql.(sh/bat)` | `render_codeql_html.(sh/bat)` | `security_reports/codeql.sarif.json` |
+| OSV-Scanner | `run_osv_scanner.(sh/bat)` | `render_osv_scanner_html.(sh/bat)` | `security_reports/osv-scanner.json` |
+| Checkov | `run_checkov.(sh/bat)` | `render_checkov_html.(sh/bat)` | `security_reports/checkov.json` |
+| tfsec | `run_tfsec.(sh/bat)` | `render_tfsec_html.(sh/bat)` | `security_reports/tfsec.json` |
+| TruffleHog | `run_trufflehog.(sh/bat)` | `render_trufflehog_html.(sh/bat)` | `security_reports/trufflehog.json` |
+
+### Bandit End-To-End Example
+
+Generate JSON first, then render HTML:
 
 ```bash
-srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
-srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
-srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
-srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
-srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
-srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
+# Linux/macOS
+bash scripts/run_bandit.sh security_reports src
+bash scripts/render_bandit_html.sh security_reports my-python-project
+
+# Windows
+scripts\run_bandit.bat security_reports src
+scripts\render_bandit_html.bat security_reports my-python-project
+```
+
+### Other Run Script Usage
+
+```bash
+# Linux/macOS
+bash scripts/run_trivy.sh security_reports alpine:latest
+bash scripts/run_safety.sh security_reports requirements.txt
+bash scripts/run_gitleaks.sh security_reports .
+bash scripts/run_semgrep.sh security_reports .
+bash scripts/run_codeql.sh security_reports codeql-db codeql/python-queries
+bash scripts/run_osv_scanner.sh security_reports .
+bash scripts/run_checkov.sh security_reports .
+bash scripts/run_tfsec.sh security_reports .
+bash scripts/run_trufflehog.sh security_reports .
+
+# Windows
+scripts\run_trivy.bat security_reports alpine:latest
+scripts\run_safety.bat security_reports requirements.txt
+scripts\run_gitleaks.bat security_reports .
+scripts\run_semgrep.bat security_reports .
+scripts\run_codeql.bat security_reports codeql-db codeql/python-queries
+scripts\run_osv_scanner.bat security_reports .
+scripts\run_checkov.bat security_reports .
+scripts\run_tfsec.bat security_reports .
+scripts\run_trufflehog.bat security_reports .
 ```
 
-Render Bandit JSON:
+### Trivy and Gitleaks End-To-End
+
+Generate JSON and then render HTML using wrapper scripts:
 
 ```bash
-srk render bandit --input bandit-report.json --output security_reports/report-bandit.html --target my-python-project
+# Linux/macOS
+bash scripts/run_trivy.sh security_reports your-image:tag
+bash scripts/render_trivy_html.sh security_reports your-image:tag
+
+bash scripts/run_gitleaks.sh security_reports .
+bash scripts/render_gitleaks_html.sh security_reports my-repository
+
+# Windows
+scripts\run_trivy.bat security_reports your-image:tag
+scripts\render_trivy_html.bat security_reports your-image:tag
+
+scripts\run_gitleaks.bat security_reports .
+scripts\render_gitleaks_html.bat security_reports my-repository
 ```
 
-Render Gitleaks JSON:
+Manual CLI render examples:
 
 ```bash
-srk render gitleaks --input gitleaks-report.json --output security_reports/report-gitleaks.html --target my-repository
+srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
+srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
+srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
+srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
+srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
+srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
+srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --target my-python-project
+srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --target my-repository
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --target my-image
 ```
+
 ## MCP Server
 
 Run MCP server over stdio:
@@ -209,12 +339,12 @@ srk mcp serve --transport stdio
 ### Available MCP Tools
 
 | Tool | Description |
-|---|---|
+| --- | --- |
 | `summarize_json` | Summarize vulnerabilities by severity from a JSON file |
 | `render_report_from_json` | Parse JSON and render an HTML report to disk |
 | `validate_input` | Validate that a JSON file is parseable and return finding count |
 
-All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
+All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"safety"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
 
 ---
 
@@ -307,6 +437,7 @@ Edit `~/.codeium/windsurf/mcp_config.json`:
 If the package is installed in a `.venv`, use the full path to avoid PATH issues:
 
 **Windows:**
+
 ```json
 {
   "command": "C:/MyProjects/sec-report-kit/.venv/Scripts/srk.exe",
@@ -315,6 +446,7 @@ If the package is installed in a `.venv`, use the full path to avoid PATH issues
 ```
 
 **macOS / Linux:**
+
 ```json
 {
   "command": "/home/user/sec-report-kit/.venv/bin/srk",

{sec_report_kit-0.2.1 → sec_report_kit-0.2.3}/README.md

@@ -2,10 +2,13 @@
 
 Generate HTML vulnerability reports from multiple security tools (SAST, SCA, IaC, and secrets) with a CLI and MCP server.
 
+Release history: see `CHANGELOG.md`.
+
 Supported source types:
 
 - `trivy`
 - `pip-audit`
+- `safety`
 - `bandit`
 - `gitleaks`
 - `semgrep`
@@ -46,10 +49,18 @@ Render pip-audit JSON:
 srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
 ```
 
+Render Safety JSON:
+
+```bash
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+```
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
 
+When render helpers are called without an explicit `<target_name>`, they automatically use the repository root folder name as the report target label.
+
 Install this package and Python-installable scanners:
 
 ```bash
@@ -60,7 +71,7 @@ bash scripts/install_tools.sh
 scripts\install_tools.bat
 ```
 
-After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and download required binaries. The `.tools/` folder is intentionally not committed to git.
+After cloning on a new machine, run the install script above to recreate the local `.tools/` directory and install required external CLI binaries (`codeql`, `tfsec`, `gitleaks`, `trufflehog`, `osv-scanner`) alongside Python dependencies. The `.tools/` folder is intentionally not committed to git.
 
 Run all unit tests locally with coverage:
 
@@ -86,6 +97,51 @@ scripts\run_pip_audit.bat
 scripts\run_pip_audit.bat reports requirements.txt
 ```
 
+Run Safety CLI and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <requirements_file>)
+bash scripts/run_safety.sh
+bash scripts/run_safety.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <requirements_file>)
+scripts\run_safety.bat
+scripts\run_safety.bat security_reports requirements.txt
+```
+
+> **Offline / local DB support**: Safety CLI requires network access by default. To enable offline scanning,
+> download the vulnerability DB while online and cache it locally:
+>
+> ```bash
+> # Linux/macOS — download once, reuse offline
+> bash scripts/download_safety_db.sh
+>
+> # Windows
+> scripts\download_safety_db.bat
+> ```
+>
+> ```bash
+> # Corporate/proxy environments with self-signed certificates
+> bash scripts/download_safety_db.sh .tools/safety-db --no-verify-ssl
+> scripts\download_safety_db.bat .tools\safety-db --no-verify-ssl
+> ```
+>
+> The DB is saved to `.tools/safety-db/`. Both `run_safety.sh` and `run_safety.bat` automatically detect
+> and use it on subsequent runs, skipping the network call. Re-run the download script periodically to
+> refresh the DB with the latest vulnerabilities.
+
+Run Bandit and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_path>)
+bash scripts/run_bandit.sh
+bash scripts/run_bandit.sh security_reports src
+
+# Windows (optional args: <report_dir> <target_path>)
+scripts\run_bandit.bat
+scripts\run_bandit.bat security_reports src
+```
+
 Convert pip-audit JSON report to HTML:
 
 ```bash
@@ -98,6 +154,18 @@ scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
 ```
 
+Convert Safety JSON report to HTML:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_safety_html.sh
+bash scripts/render_safety_html.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_safety_html.bat
+scripts\render_safety_html.bat security_reports requirements.txt
+```
+
 These render helpers generate the HTML file and open it automatically in your default browser.
 
 Convert sample Trivy JSON report to HTML:
@@ -140,37 +208,99 @@ By default, JSON is written to `reports/pip-audit.json` and HTML to `reports/pip
 
 ## Additional Tool Workflows
 
-Each workflow has paired run and render scripts in `scripts/`:
+### Script Coverage Matrix
 
-- Semgrep: `run_semgrep.(sh|bat)` and `render_semgrep_html.(sh|bat)`
-- CodeQL: `run_codeql.(sh|bat)` and `render_codeql_html.(sh|bat)`
-- OSV-Scanner: `run_osv_scanner.(sh|bat)` and `render_osv_scanner_html.(sh|bat)`
-- Checkov: `run_checkov.(sh|bat)` and `render_checkov_html.(sh|bat)`
-- tfsec: `run_tfsec.(sh|bat)` and `render_tfsec_html.(sh|bat)`
-- TruffleHog: `run_trufflehog.(sh|bat)` and `render_trufflehog_html.(sh|bat)`
+The table below reflects what is currently implemented in `scripts/`:
 
-Manual CLI render examples:
+| Tool | Run Script (JSON/SARIF) | Render Script (HTML) | Default JSON/SARIF Output |
+| --- | --- | --- | --- |
+| Trivy | `run_trivy.(sh/bat)` | `render_trivy_html.(sh/bat)` | `security_reports/trivy-image-report-v1.0.21.json` |
+| pip-audit | `run_pip_audit.(sh/bat)` | `render_pip_audit_html.(sh/bat)` | `reports/pip-audit.json` |
+| Safety | `run_safety.(sh/bat)` | `render_safety_html.(sh/bat)` | `security_reports/safety.json` |
+| Bandit | `run_bandit.(sh/bat)` | `render_bandit_html.(sh/bat)` | `security_reports/bandit.json` |
+| Gitleaks | `run_gitleaks.(sh/bat)` | `render_gitleaks_html.(sh/bat)` | `security_reports/gitleaks.json` |
+| Semgrep | `run_semgrep.(sh/bat)` | `render_semgrep_html.(sh/bat)` | `security_reports/semgrep.json` |
+| CodeQL | `run_codeql.(sh/bat)` | `render_codeql_html.(sh/bat)` | `security_reports/codeql.sarif.json` |
+| OSV-Scanner | `run_osv_scanner.(sh/bat)` | `render_osv_scanner_html.(sh/bat)` | `security_reports/osv-scanner.json` |
+| Checkov | `run_checkov.(sh/bat)` | `render_checkov_html.(sh/bat)` | `security_reports/checkov.json` |
+| tfsec | `run_tfsec.(sh/bat)` | `render_tfsec_html.(sh/bat)` | `security_reports/tfsec.json` |
+| TruffleHog | `run_trufflehog.(sh/bat)` | `render_trufflehog_html.(sh/bat)` | `security_reports/trufflehog.json` |
+
+### Bandit End-To-End Example
+
+Generate JSON first, then render HTML:
 
 ```bash
-srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
-srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
-srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
-srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
-srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
-srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
+# Linux/macOS
+bash scripts/run_bandit.sh security_reports src
+bash scripts/render_bandit_html.sh security_reports my-python-project
+
+# Windows
+scripts\run_bandit.bat security_reports src
+scripts\render_bandit_html.bat security_reports my-python-project
+```
+
+### Other Run Script Usage
+
+```bash
+# Linux/macOS
+bash scripts/run_trivy.sh security_reports alpine:latest
+bash scripts/run_safety.sh security_reports requirements.txt
+bash scripts/run_gitleaks.sh security_reports .
+bash scripts/run_semgrep.sh security_reports .
+bash scripts/run_codeql.sh security_reports codeql-db codeql/python-queries
+bash scripts/run_osv_scanner.sh security_reports .
+bash scripts/run_checkov.sh security_reports .
+bash scripts/run_tfsec.sh security_reports .
+bash scripts/run_trufflehog.sh security_reports .
+
+# Windows
+scripts\run_trivy.bat security_reports alpine:latest
+scripts\run_safety.bat security_reports requirements.txt
+scripts\run_gitleaks.bat security_reports .
+scripts\run_semgrep.bat security_reports .
+scripts\run_codeql.bat security_reports codeql-db codeql/python-queries
+scripts\run_osv_scanner.bat security_reports .
+scripts\run_checkov.bat security_reports .
+scripts\run_tfsec.bat security_reports .
+scripts\run_trufflehog.bat security_reports .
 ```
 
-Render Bandit JSON:
+### Trivy and Gitleaks End-To-End
+
+Generate JSON and then render HTML using wrapper scripts:
 
 ```bash
-srk render bandit --input bandit-report.json --output security_reports/report-bandit.html --target my-python-project
+# Linux/macOS
+bash scripts/run_trivy.sh security_reports your-image:tag
+bash scripts/render_trivy_html.sh security_reports your-image:tag
+
+bash scripts/run_gitleaks.sh security_reports .
+bash scripts/render_gitleaks_html.sh security_reports my-repository
+
+# Windows
+scripts\run_trivy.bat security_reports your-image:tag
+scripts\render_trivy_html.bat security_reports your-image:tag
+
+scripts\run_gitleaks.bat security_reports .
+scripts\render_gitleaks_html.bat security_reports my-repository
 ```
 
-Render Gitleaks JSON:
+Manual CLI render examples:
 
 ```bash
-srk render gitleaks --input gitleaks-report.json --output security_reports/report-gitleaks.html --target my-repository
+srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
+srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
+srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
+srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
+srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
+srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
+srk render bandit --input security_reports/bandit.json --output security_reports/bandit-report.html --target my-python-project
+srk render gitleaks --input security_reports/gitleaks.json --output security_reports/gitleaks-report.html --target my-repository
+srk render trivy --input security_reports/trivy-image-report-v1.0.21.json --output security_reports/trivy-report.html --target my-image
 ```
+
 ## MCP Server
 
 Run MCP server over stdio:
@@ -182,12 +312,12 @@ srk mcp serve --transport stdio
 ### Available MCP Tools
 
 | Tool | Description |
-|---|---|
+| --- | --- |
 | `summarize_json` | Summarize vulnerabilities by severity from a JSON file |
 | `render_report_from_json` | Parse JSON and render an HTML report to disk |
 | `validate_input` | Validate that a JSON file is parseable and return finding count |
 
-All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
+All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"safety"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
 
 ---
 
@@ -280,6 +410,7 @@ Edit `~/.codeium/windsurf/mcp_config.json`:
 If the package is installed in a `.venv`, use the full path to avoid PATH issues:
 
 **Windows:**
+
 ```json
 {
   "command": "C:/MyProjects/sec-report-kit/.venv/Scripts/srk.exe",
@@ -288,6 +419,7 @@ If the package is installed in a `.venv`, use the full path to avoid PATH issues
 ```
 
 **macOS / Linux:**
+
 ```json
 {
   "command": "/home/user/sec-report-kit/.venv/bin/srk",

sec_report_kit-0.2.3/check_assets.py

@@ -0,0 +1,63 @@
+import sys
+import os
+import json
+import re
+import urllib.request
+
+tool_matrix = {
+    "codeql": {
+        "repo": "github/codeql-action",
+        "patterns": [r"codeql-bundle-win64\.tar\.gz$", r"codeql-bundle-win64\.zip$"],
+    },
+    "tfsec": {
+        "repo": "aquasecurity/tfsec",
+        "patterns": [r"tfsec-windows-amd64(?:\.exe)?$"],
+    },
+    "gitleaks": {
+        "repo": "gitleaks/gitleaks",
+        "patterns": [r"gitleaks_.*_windows_x64\.zip$"],
+    },
+    "trufflehog": {
+        "repo": "trufflesecurity/trufflehog",
+        "patterns": [r"trufflehog_.*_windows_amd64\.tar\.gz$", r"trufflehog_.*_windows_amd64\.zip$"],
+    },
+    "osv-scanner": {
+        "repo": "google/osv-scanner",
+        "patterns": [r"osv-scanner_.*_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner-windows-amd64(?:\.exe)?$"],
+    },
+}
+
+def check_tools():
+    for tool_name, cfg in tool_matrix.items():
+        repo = cfg["repo"]
+        patterns = cfg["patterns"]
+        try:
+            req = urllib.request.Request(
+                f"https://api.github.com/repos/{repo}/releases/latest",
+                headers={"Accept": "application/vnd.github+json", "User-Agent": "python-check-script"},
+            )
+            with urllib.request.urlopen(req, timeout=30) as resp:
+                release = json.load(resp)
+            
+            assets = [a["name"] for a in release.get("assets", [])]
+            match_found = False
+            for pattern in patterns:
+                regex = re.compile(pattern)
+                for asset in assets:
+                    if regex.search(asset):
+                        print(f"{tool_name}: PASS (Matched asset: {asset})")
+                        match_found = True
+                        break
+                if match_found:
+                    break
+            
+            if not match_found:
+                print(f"{tool_name}: FAIL (No asset matched patterns)")
+                # Print available assets for debugging if call fails
+                # print(f"  Available: {assets[:3]}...") 
+                
+        except Exception as e:
+            print(f"{tool_name}: FAIL (Error: {e})")
+
+if __name__ == "__main__":
+    check_tools()

{sec_report_kit-0.2.1 → sec_report_kit-0.2.3}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.2.1"
-description = "Generate HTML security reports from Trivy, pip-audit, Bandit, and Gitleaks JSON"
+version = "0.2.3"
+description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Ravi Konduru" }]
-keywords = ["security", "trivy", "pip-audit", "mcp", "cli", "report"]
+keywords = ["security", "trivy", "pip-audit", "safety", "mcp", "cli", "report"]
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Intended Audience :: Developers",

sec_report_kit-0.2.3/scripts/download_safety_db.bat

@@ -0,0 +1,13 @@
+@echo off
+setlocal
+
+set "PYTHON_BIN=python"
+if exist "%~dp0..\.venv\Scripts\python.exe" set "PYTHON_BIN=%~dp0..\.venv\Scripts\python.exe"
+
+set "OUTPUT_DIR=%~1"
+if "%OUTPUT_DIR%"=="" set "OUTPUT_DIR=.tools\safety-db"
+
+rem Pass remaining flags (e.g. --full, --no-verify-ssl) directly to the Python script
+"%PYTHON_BIN%" "%~dp0download_safety_db.py" --output-dir "%OUTPUT_DIR%" %2 %3 %4
+
+exit /b %ERRORLEVEL%