sec-report-kit 0.2.2__tar.gz → 0.2.3__tar.gz

{sec_report_kit-0.2.2 → sec_report_kit-0.2.3}/.gitignore

@@ -36,6 +36,15 @@ pip-delete-this-directory.txt
 
 # Unit test / coverage reports
 htmlcov/
+class_index.html
+function_index.html
+index.html
+status.json
+coverage_html_*.js
+favicon_32_*.png
+keybd_closed_*.png
+style_*.css
+z_*.html
 .tox/
 .nox/
 .coverage

sec_report_kit-0.2.3/CHANGELOG.md

@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## 0.2.3 - 2026-05-13
+
+### Added
+- Safety CLI parser support and HTML rendering flow.
+- New CLI command: `srk render safety`.
+- MCP support for `source_type="safety"`.
+- Helper scripts for Safety scan and render:
+  - `scripts/run_safety.sh`
+  - `scripts/run_safety.bat`
+  - `scripts/render_safety_html.sh`
+  - `scripts/render_safety_html.bat`
+- Offline Safety DB download helpers:
+  - `scripts/download_safety_db.py`
+  - `scripts/download_safety_db.sh`
+  - `scripts/download_safety_db.bat`
+
+### Changed
+- Auto-detection now recognizes Safety JSON payloads.
+- Tool installation scripts now install Safety CLI in the app venv.
+- README updated with Safety usage and offline/local DB workflow guidance.
+
+### Fixed
+- Safety run scripts now avoid false success when network failures occur.
+- JSON output validation improved for Safety execution paths.

{sec_report_kit-0.2.2 → sec_report_kit-0.2.3}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: sec-report-kit
-Version: 0.2.2
-Summary: Generate HTML security reports from Trivy, pip-audit, Bandit, and Gitleaks JSON
+Version: 0.2.3
+Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT
-Keywords: cli,mcp,pip-audit,report,security,trivy
+Keywords: cli,mcp,pip-audit,report,safety,security,trivy
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
@@ -29,10 +29,13 @@ Description-Content-Type: text/markdown
 
 Generate HTML vulnerability reports from multiple security tools (SAST, SCA, IaC, and secrets) with a CLI and MCP server.
 
+Release history: see `CHANGELOG.md`.
+
 Supported source types:
 
 - `trivy`
 - `pip-audit`
+- `safety`
 - `bandit`
 - `gitleaks`
 - `semgrep`
@@ -73,6 +76,12 @@ Render pip-audit JSON:
 srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
 ```
 
+Render Safety JSON:
+
+```bash
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+```
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
@@ -115,6 +124,39 @@ scripts\run_pip_audit.bat
 scripts\run_pip_audit.bat reports requirements.txt
 ```
 
+Run Safety CLI and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <requirements_file>)
+bash scripts/run_safety.sh
+bash scripts/run_safety.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <requirements_file>)
+scripts\run_safety.bat
+scripts\run_safety.bat security_reports requirements.txt
+```
+
+> **Offline / local DB support**: Safety CLI requires network access by default. To enable offline scanning,
+> download the vulnerability DB while online and cache it locally:
+>
+> ```bash
+> # Linux/macOS — download once, reuse offline
+> bash scripts/download_safety_db.sh
+>
+> # Windows
+> scripts\download_safety_db.bat
+> ```
+>
+> ```bash
+> # Corporate/proxy environments with self-signed certificates
+> bash scripts/download_safety_db.sh .tools/safety-db --no-verify-ssl
+> scripts\download_safety_db.bat .tools\safety-db --no-verify-ssl
+> ```
+>
+> The DB is saved to `.tools/safety-db/`. Both `run_safety.sh` and `run_safety.bat` automatically detect
+> and use it on subsequent runs, skipping the network call. Re-run the download script periodically to
+> refresh the DB with the latest vulnerabilities.
+
 Run Bandit and write JSON output:
 
 ```bash
@@ -139,6 +181,18 @@ scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
 ```
 
+Convert Safety JSON report to HTML:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_safety_html.sh
+bash scripts/render_safety_html.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_safety_html.bat
+scripts\render_safety_html.bat security_reports requirements.txt
+```
+
 These render helpers generate the HTML file and open it automatically in your default browser.
 
 Convert sample Trivy JSON report to HTML:
@@ -189,6 +243,7 @@ The table below reflects what is currently implemented in `scripts/`:
 | --- | --- | --- | --- |
 | Trivy | `run_trivy.(sh/bat)` | `render_trivy_html.(sh/bat)` | `security_reports/trivy-image-report-v1.0.21.json` |
 | pip-audit | `run_pip_audit.(sh/bat)` | `render_pip_audit_html.(sh/bat)` | `reports/pip-audit.json` |
+| Safety | `run_safety.(sh/bat)` | `render_safety_html.(sh/bat)` | `security_reports/safety.json` |
 | Bandit | `run_bandit.(sh/bat)` | `render_bandit_html.(sh/bat)` | `security_reports/bandit.json` |
 | Gitleaks | `run_gitleaks.(sh/bat)` | `render_gitleaks_html.(sh/bat)` | `security_reports/gitleaks.json` |
 | Semgrep | `run_semgrep.(sh/bat)` | `render_semgrep_html.(sh/bat)` | `security_reports/semgrep.json` |
@@ -217,6 +272,7 @@ scripts\render_bandit_html.bat security_reports my-python-project
 ```bash
 # Linux/macOS
 bash scripts/run_trivy.sh security_reports alpine:latest
+bash scripts/run_safety.sh security_reports requirements.txt
 bash scripts/run_gitleaks.sh security_reports .
 bash scripts/run_semgrep.sh security_reports .
 bash scripts/run_codeql.sh security_reports codeql-db codeql/python-queries
@@ -227,6 +283,7 @@ bash scripts/run_trufflehog.sh security_reports .
 
 # Windows
 scripts\run_trivy.bat security_reports alpine:latest
+scripts\run_safety.bat security_reports requirements.txt
 scripts\run_gitleaks.bat security_reports .
 scripts\run_semgrep.bat security_reports .
 scripts\run_codeql.bat security_reports codeql-db codeql/python-queries
@@ -262,6 +319,7 @@ Manual CLI render examples:
 srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
 srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
 srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
 srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
 srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
 srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
@@ -286,7 +344,7 @@ srk mcp serve --transport stdio
 | `render_report_from_json` | Parse JSON and render an HTML report to disk |
 | `validate_input` | Validate that a JSON file is parseable and return finding count |
 
-All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
+All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"safety"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
 
 ---
 

{sec_report_kit-0.2.2 → sec_report_kit-0.2.3}/README.md

@@ -2,10 +2,13 @@
 
 Generate HTML vulnerability reports from multiple security tools (SAST, SCA, IaC, and secrets) with a CLI and MCP server.
 
+Release history: see `CHANGELOG.md`.
+
 Supported source types:
 
 - `trivy`
 - `pip-audit`
+- `safety`
 - `bandit`
 - `gitleaks`
 - `semgrep`
@@ -46,6 +49,12 @@ Render pip-audit JSON:
 srk render pip-audit --input pip-audit.json --output security_reports/report-pip-audit.html --target requirements.txt
 ```
 
+Render Safety JSON:
+
+```bash
+srk render safety --input security_reports/safety.json --output security_reports/report-safety.html --target requirements.txt
+```
+
 ## Helper Scripts (bat/sh)
 
 Cross-platform helper scripts are available in `scripts/`.
@@ -88,6 +97,39 @@ scripts\run_pip_audit.bat
 scripts\run_pip_audit.bat reports requirements.txt
 ```
 
+Run Safety CLI and write JSON output:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <requirements_file>)
+bash scripts/run_safety.sh
+bash scripts/run_safety.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <requirements_file>)
+scripts\run_safety.bat
+scripts\run_safety.bat security_reports requirements.txt
+```
+
+> **Offline / local DB support**: Safety CLI requires network access by default. To enable offline scanning,
+> download the vulnerability DB while online and cache it locally:
+>
+> ```bash
+> # Linux/macOS — download once, reuse offline
+> bash scripts/download_safety_db.sh
+>
+> # Windows
+> scripts\download_safety_db.bat
+> ```
+>
+> ```bash
+> # Corporate/proxy environments with self-signed certificates
+> bash scripts/download_safety_db.sh .tools/safety-db --no-verify-ssl
+> scripts\download_safety_db.bat .tools\safety-db --no-verify-ssl
+> ```
+>
+> The DB is saved to `.tools/safety-db/`. Both `run_safety.sh` and `run_safety.bat` automatically detect
+> and use it on subsequent runs, skipping the network call. Re-run the download script periodically to
+> refresh the DB with the latest vulnerabilities.
+
 Run Bandit and write JSON output:
 
 ```bash
@@ -112,6 +154,18 @@ scripts\render_pip_audit_html.bat
 scripts\render_pip_audit_html.bat reports requirements.txt
 ```
 
+Convert Safety JSON report to HTML:
+
+```bash
+# Linux/macOS (optional args: <report_dir> <target_name>)
+bash scripts/render_safety_html.sh
+bash scripts/render_safety_html.sh security_reports requirements.txt
+
+# Windows (optional args: <report_dir> <target_name>)
+scripts\render_safety_html.bat
+scripts\render_safety_html.bat security_reports requirements.txt
+```
+
 These render helpers generate the HTML file and open it automatically in your default browser.
 
 Convert sample Trivy JSON report to HTML:
@@ -162,6 +216,7 @@ The table below reflects what is currently implemented in `scripts/`:
 | --- | --- | --- | --- |
 | Trivy | `run_trivy.(sh/bat)` | `render_trivy_html.(sh/bat)` | `security_reports/trivy-image-report-v1.0.21.json` |
 | pip-audit | `run_pip_audit.(sh/bat)` | `render_pip_audit_html.(sh/bat)` | `reports/pip-audit.json` |
+| Safety | `run_safety.(sh/bat)` | `render_safety_html.(sh/bat)` | `security_reports/safety.json` |
 | Bandit | `run_bandit.(sh/bat)` | `render_bandit_html.(sh/bat)` | `security_reports/bandit.json` |
 | Gitleaks | `run_gitleaks.(sh/bat)` | `render_gitleaks_html.(sh/bat)` | `security_reports/gitleaks.json` |
 | Semgrep | `run_semgrep.(sh/bat)` | `render_semgrep_html.(sh/bat)` | `security_reports/semgrep.json` |
@@ -190,6 +245,7 @@ scripts\render_bandit_html.bat security_reports my-python-project
 ```bash
 # Linux/macOS
 bash scripts/run_trivy.sh security_reports alpine:latest
+bash scripts/run_safety.sh security_reports requirements.txt
 bash scripts/run_gitleaks.sh security_reports .
 bash scripts/run_semgrep.sh security_reports .
 bash scripts/run_codeql.sh security_reports codeql-db codeql/python-queries
@@ -200,6 +256,7 @@ bash scripts/run_trufflehog.sh security_reports .
 
 # Windows
 scripts\run_trivy.bat security_reports alpine:latest
+scripts\run_safety.bat security_reports requirements.txt
 scripts\run_gitleaks.bat security_reports .
 scripts\run_semgrep.bat security_reports .
 scripts\run_codeql.bat security_reports codeql-db codeql/python-queries
@@ -235,6 +292,7 @@ Manual CLI render examples:
 srk render semgrep --input security_reports/semgrep.json --output security_reports/semgrep-report.html --target my-repo
 srk render codeql --input security_reports/codeql.sarif.json --output security_reports/codeql-report.html --target my-repo
 srk render osv-scanner --input security_reports/osv-scanner.json --output security_reports/osv-scanner-report.html --target requirements.txt
+srk render safety --input security_reports/safety.json --output security_reports/safety-report.html --target requirements.txt
 srk render checkov --input security_reports/checkov.json --output security_reports/checkov-report.html --target terraform
 srk render tfsec --input security_reports/tfsec.json --output security_reports/tfsec-report.html --target terraform
 srk render trufflehog --input security_reports/trufflehog.json --output security_reports/trufflehog-report.html --target my-repo
@@ -259,7 +317,7 @@ srk mcp serve --transport stdio
 | `render_report_from_json` | Parse JSON and render an HTML report to disk |
 | `validate_input` | Validate that a JSON file is parseable and return finding count |
 
-All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
+All tools accept `source_type` (`"trivy"`, `"pip-audit"`, `"safety"`, `"bandit"`, `"gitleaks"`, `"semgrep"`, `"codeql"`, `"osv-scanner"`, `"checkov"`, `"tfsec"`, `"trufflehog"`, or `"auto"`) and `input_path` (absolute path to JSON file).
 
 ---
 

sec_report_kit-0.2.3/check_assets.py

@@ -0,0 +1,63 @@
+import sys
+import os
+import json
+import re
+import urllib.request
+
+tool_matrix = {
+    "codeql": {
+        "repo": "github/codeql-action",
+        "patterns": [r"codeql-bundle-win64\.tar\.gz$", r"codeql-bundle-win64\.zip$"],
+    },
+    "tfsec": {
+        "repo": "aquasecurity/tfsec",
+        "patterns": [r"tfsec-windows-amd64(?:\.exe)?$"],
+    },
+    "gitleaks": {
+        "repo": "gitleaks/gitleaks",
+        "patterns": [r"gitleaks_.*_windows_x64\.zip$"],
+    },
+    "trufflehog": {
+        "repo": "trufflesecurity/trufflehog",
+        "patterns": [r"trufflehog_.*_windows_amd64\.tar\.gz$", r"trufflehog_.*_windows_amd64\.zip$"],
+    },
+    "osv-scanner": {
+        "repo": "google/osv-scanner",
+        "patterns": [r"osv-scanner_.*_windows_amd64(?:\.exe)?(?:\.zip)?$", r"osv-scanner-windows-amd64(?:\.exe)?$"],
+    },
+}
+
+def check_tools():
+    for tool_name, cfg in tool_matrix.items():
+        repo = cfg["repo"]
+        patterns = cfg["patterns"]
+        try:
+            req = urllib.request.Request(
+                f"https://api.github.com/repos/{repo}/releases/latest",
+                headers={"Accept": "application/vnd.github+json", "User-Agent": "python-check-script"},
+            )
+            with urllib.request.urlopen(req, timeout=30) as resp:
+                release = json.load(resp)
+            
+            assets = [a["name"] for a in release.get("assets", [])]
+            match_found = False
+            for pattern in patterns:
+                regex = re.compile(pattern)
+                for asset in assets:
+                    if regex.search(asset):
+                        print(f"{tool_name}: PASS (Matched asset: {asset})")
+                        match_found = True
+                        break
+                if match_found:
+                    break
+            
+            if not match_found:
+                print(f"{tool_name}: FAIL (No asset matched patterns)")
+                # Print available assets for debugging if call fails
+                # print(f"  Available: {assets[:3]}...") 
+                
+        except Exception as e:
+            print(f"{tool_name}: FAIL (Error: {e})")
+
+if __name__ == "__main__":
+    check_tools()

{sec_report_kit-0.2.2 → sec_report_kit-0.2.3}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.2.2"
-description = "Generate HTML security reports from Trivy, pip-audit, Bandit, and Gitleaks JSON"
+version = "0.2.3"
+description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Ravi Konduru" }]
-keywords = ["security", "trivy", "pip-audit", "mcp", "cli", "report"]
+keywords = ["security", "trivy", "pip-audit", "safety", "mcp", "cli", "report"]
 classifiers = [
   "Development Status :: 3 - Alpha",
   "Intended Audience :: Developers",

sec_report_kit-0.2.3/scripts/download_safety_db.bat

@@ -0,0 +1,13 @@
+@echo off
+setlocal
+
+set "PYTHON_BIN=python"
+if exist "%~dp0..\.venv\Scripts\python.exe" set "PYTHON_BIN=%~dp0..\.venv\Scripts\python.exe"
+
+set "OUTPUT_DIR=%~1"
+if "%OUTPUT_DIR%"=="" set "OUTPUT_DIR=.tools\safety-db"
+
+rem Pass remaining flags (e.g. --full, --no-verify-ssl) directly to the Python script
+"%PYTHON_BIN%" "%~dp0download_safety_db.py" --output-dir "%OUTPUT_DIR%" %2 %3 %4
+
+exit /b %ERRORLEVEL%

sec_report_kit-0.2.3/scripts/download_safety_db.py

@@ -0,0 +1,125 @@
+"""
+Download the Safety CLI vulnerability database (schema 2.0.0) for offline use.
+
+Usage:
+    python scripts/download_safety_db.py [--output-dir .tools/safety-db] [--no-verify-ssl]
+
+The script downloads insecure.json (and optionally insecure_full.json) from the
+Safety free open mirror and saves them to a local directory that can be passed
+to `safety check --db <dir>` for offline scanning.
+"""
+import argparse
+import json
+import ssl
+import sys
+import urllib.request
+from pathlib import Path
+
+OPEN_MIRROR = "https://pyup.io/aws/safety/free/2.0.0/"
+SCHEMA_VERSION = "2.0.0"
+DB_FILES = ["insecure.json", "insecure_full.json"]
+
+
+def _make_ssl_context(verify: bool) -> ssl.SSLContext:
+    if verify:
+        ctx = ssl.create_default_context()
+        # Try to load certifi certs if available (helps in corporate environments)
+        try:
+            import certifi  # type: ignore[import]
+            ctx = ssl.create_default_context(cafile=certifi.where())
+        except ImportError:
+            pass
+    else:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+    return ctx
+
+
+def download_db(output_dir: str = ".tools/safety-db", full: bool = False, verify_ssl: bool = True) -> int:
+    """
+    Download Safety vulnerability DB files to *output_dir*.
+
+    Returns 0 on success, 1 on failure.
+    """
+    dest = Path(output_dir)
+    dest.mkdir(parents=True, exist_ok=True)
+
+    files_to_download = DB_FILES if full else [DB_FILES[0]]
+
+    headers = {
+        "schema-version": SCHEMA_VERSION,
+        "ecosystem": "python",
+        "User-Agent": "sec-report-kit/1.0 safety-db-downloader",
+    }
+
+    ssl_ctx = _make_ssl_context(verify_ssl)
+    if not verify_ssl:
+        import warnings
+        warnings.warn("SSL certificate verification is disabled.", UserWarning, stacklevel=2)
+
+    success = True
+    for db_file in files_to_download:
+        url = OPEN_MIRROR + db_file
+        dest_file = dest / db_file
+        print(f"Downloading {url} ...", end=" ", flush=True)
+        try:
+            req = urllib.request.Request(url, headers=headers)
+            with urllib.request.urlopen(req, timeout=30, context=ssl_ctx) as response:
+                raw = response.read()
+
+            # Validate JSON and schema version
+            data = json.loads(raw)
+            schema = (data.get("meta") or {}).get("schema_version", "unknown")
+            if schema != SCHEMA_VERSION:
+                print(f"FAIL (unexpected schema version: {schema})")
+                success = False
+                continue
+
+            dest_file.write_bytes(raw)
+            size_kb = len(raw) // 1024
+            print(f"OK ({size_kb} KB, schema {schema})")
+
+        except Exception as exc:
+            print(f"FAIL ({exc})")
+            success = False
+
+    if success:
+        print(f"\nSafety DB saved to: {dest.resolve()}")
+        print(f"Use it with: safety check --db \"{dest.resolve()}\"")
+    else:
+        print("\nOne or more files failed to download.", file=sys.stderr)
+        if verify_ssl:
+            print(
+                "If you are behind a corporate proxy, try adding --no-verify-ssl",
+                file=sys.stderr,
+            )
+
+    return 0 if success else 1
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Download Safety CLI vulnerability DB for offline use."
+    )
+    parser.add_argument(
+        "--output-dir",
+        default=".tools/safety-db",
+        help="Directory to save DB files (default: .tools/safety-db)",
+    )
+    parser.add_argument(
+        "--full",
+        action="store_true",
+        help="Also download insecure_full.json (larger, includes CVE descriptions)",
+    )
+    parser.add_argument(
+        "--no-verify-ssl",
+        action="store_true",
+        help="Disable SSL certificate verification (use in corporate/proxy environments)",
+    )
+    args = parser.parse_args()
+    return download_db(output_dir=args.output_dir, full=args.full, verify_ssl=not args.no_verify_ssl)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

sec_report_kit-0.2.3/scripts/download_safety_db.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PYTHON_BIN="${PYTHON_BIN:-python}"
+if [[ -x "$(dirname "$0")/../.venv/bin/python" ]]; then
+  PYTHON_BIN="$(dirname "$0")/../.venv/bin/python"
+fi
+
+OUTPUT_DIR="${1:-.tools/safety-db}"
+shift || true
+
+# Pass remaining flags (e.g. --full, --no-verify-ssl) directly to the Python script
+"${PYTHON_BIN}" "$(dirname "$0")/download_safety_db.py" --output-dir "${OUTPUT_DIR}" "$@"