sec-report-kit 0.7.0__tar.gz → 0.7.2__tar.gz

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented in this file.
 
+## 0.7.2 - 2026-11-04
+
+### Fixed
+- MCP tool calls with an explicit `null` argument now get a short validation error (`argument 'source_type' must be a string, got null`) instead of raw pydantic output. `null` is accepted only where the tool's schema allows it.
+- Invalid input on the MCP server's stdio stream now gets a JSON-RPC 2.0 error instead of being silently dropped: `-32700` for unparseable JSON, and `-32600` for invalid requests and batch arrays, echoing the request id when it can be read and `null` otherwise. Blank lines are ignored. The server now uses its own stdio reader in place of the SDK's.
+
+## 0.7.1 - 2026-11-04
+
+### Security
+- Bumped pinned dependencies in `requirements.txt` to clear 13 fixable CVEs (1 critical, 2 high, 10 medium) reported by the Trivy filesystem audit, plus one pip-audit advisory: certifi 2026.10.18 (compromised emSign intermediate CA keys), filelock 4.2.1, msgpack 1.2.3, mcp 1.30.0, python-multipart 0.0.31.
+
+### Fixed
+- Removed a stale `-e git+...#egg=sec_report_kit` entry from `requirements.txt` that made `pip install -r requirements.txt` replace a local checkout with an old commit of the package.
+
 ## 0.7.0 - 2026-11-04
 
 ### Added

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sec-report-kit
-Version: 0.7.0
+Version: 0.7.2
 Summary: Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON
 Author: Ravi Konduru
 License: MIT

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sec-report-kit"
-version = "0.7.0"
+version = "0.7.2"
 description = "Generate HTML security reports from Trivy, pip-audit, Safety, Bandit, and Gitleaks JSON"
 readme = "README.md"
 requires-python = ">=3.10"

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/requirements.txt

@@ -6,7 +6,7 @@ bandit==1.9.4
 boolean.py==5.0
 build==1.5.0
 CacheControl==0.14.4
-certifi==2026.4.22
+certifi==2026.10.18
 cffi==2.0.0
 charset-normalizer==3.4.7
 click==8.3.3
@@ -16,7 +16,7 @@ cryptography==50.0.0
 cyclonedx-python-lib==11.7.0
 defusedxml==0.7.1
 docutils==0.22.4
-filelock==3.29.0
+filelock==4.2.1
 h11==0.16.0
 httpcore==1.0.9
 httpx==0.28.1
@@ -32,10 +32,10 @@ jsonschema-specifications==2025.9.1
 keyring==25.7.0
 license-expression==30.4.4
 markdown-it-py==4.0.0
-mcp==1.28.1
+mcp==1.30.0
 mdurl==0.1.2
 more-itertools==11.0.2
-msgpack==1.2.1
+msgpack==1.2.3
 nh3==0.3.5
 packageurl-python==0.17.6
 packaging==26.2
@@ -57,7 +57,7 @@ pyproject_hooks==1.2.0
 pytest==9.0.3
 pytest-cov==7.1.0
 python-dotenv==1.2.2
-python-multipart==0.0.30
+python-multipart==0.0.31
 pywin32==311
 pywin32-ctypes==0.2.3
 PyYAML==6.0.3
@@ -68,7 +68,6 @@ requests-toolbelt==1.0.0
 rfc3986==2.0.0
 rich==15.0.0
 rpds-py==0.30.0
--e git+https://github.com/ShanKonduru/sec-report-kit.git@b6d196bac687e07189e884e2fe25af5c8842da1d#egg=sec_report_kit
 shellingham==1.5.4
 sortedcontainers==2.4.0
 sse-starlette==3.4.1

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/src/sec_report_kit/__init__.py

@@ -1,4 +1,4 @@
 """sec_report_kit package."""
 
 __all__ = ["__version__"]
-__version__ = "0.7.0"
+__version__ = "0.7.2"

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/src/sec_report_kit/mcp/protocol.py

@@ -15,6 +15,7 @@ The SDK leaves a few rough edges that strict clients notice:
 
 from __future__ import annotations
 
+import json
 import typing
 from typing import Any, Callable, Iterable
 
@@ -34,6 +35,19 @@ def _type_ok(value: Any, json_type: str) -> bool:
     return isinstance(value, _JSON_TYPES.get(json_type, (object,)))
 
 
+def _types_of(prop: dict) -> list[str]:
+    declared = prop.get("type")
+    if declared is None:
+        return []
+    return list(declared) if isinstance(declared, list) else [declared]
+
+
+def _allows_null(prop: dict) -> bool:
+    if "null" in _types_of(prop):
+        return True
+    return any(_allows_null(sub) for key in ("anyOf", "oneOf") for sub in prop.get(key, []))
+
+
 def validate_arguments(tool_name: str, schema: dict, arguments: Any) -> list[str]:
     """Return human-readable problems with ``arguments``; empty when valid."""
     if arguments is None:
@@ -51,9 +65,16 @@ def validate_arguments(tool_name: str, schema: dict, arguments: Any) -> list[str
                 f"unexpected argument '{name}' (allowed: {', '.join(sorted(properties))})"
             )
             continue
-        json_type = properties[name].get("type")
-        if json_type and value is not None and not _type_ok(value, json_type):
-            problems.append(f"argument '{name}' must be a {json_type}, got {type(value).__name__}")
+        prop = properties[name]
+        types = [t for t in _types_of(prop) if t != "null"]
+        expected = " or ".join(types) if types else "value"
+        if value is None:
+            # An explicit null must be checked too: pydantic rejects it for a
+            # plain `str` parameter and would otherwise leak its raw message.
+            if not _allows_null(prop):
+                problems.append(f"argument '{name}' must be a {expected}, got null")
+        elif types and not any(_type_ok(value, t) for t in types):
+            problems.append(f"argument '{name}' must be a {expected}, got {type(value).__name__}")
     return problems
 
 
@@ -106,3 +127,70 @@ async def filter_requests(
                         await reply(root, INVALID_PARAMS, f"Unknown tool: {name}")
                         continue
             await forward_stream.send(item)
+
+
+# ---------------------------------------------------------------------------
+# stdio transport
+#
+# The SDK's stdio reader turns any line that is not a valid JSON-RPC message
+# into an exception the server only logs, so the sender gets no response (and
+# a request with an id is never answered). JSON-RPC 2.0 requires -32700 for
+# unparseable JSON and -32600 for an invalid request, with "id": null when the
+# id cannot be read. The SDK's JSONRPCError cannot carry a null id, so these
+# replies are written as raw JSON by this transport.
+# ---------------------------------------------------------------------------
+
+PARSE_ERROR = -32700
+INVALID_REQUEST = -32600
+
+
+def _error_line(request_id: Any, code: int, message: str) -> str:
+    return json.dumps({"jsonrpc": "2.0", "id": request_id, "error": {"code": code, "message": message}})
+
+
+def parse_line(line: str) -> Any:
+    """Classify one line of stdin.
+
+    Returns a ``SessionMessage`` for a valid JSON-RPC message, a ``str`` (the
+    JSON-RPC error response to write back) for invalid input, or ``None`` for
+    a blank line.
+    """
+    from mcp.shared.message import SessionMessage
+    from mcp.types import JSONRPCMessage
+
+    if not line.strip():
+        return None
+    try:
+        payload = json.loads(line)
+    except ValueError:
+        return _error_line(None, PARSE_ERROR, "Parse error: invalid JSON")
+    if isinstance(payload, list):
+        return _error_line(None, INVALID_REQUEST, "Invalid Request: batch requests are not supported")
+    try:
+        return SessionMessage(message=JSONRPCMessage.model_validate(payload))
+    except Exception:
+        request_id = payload.get("id") if isinstance(payload, dict) else None
+        if isinstance(request_id, bool) or not isinstance(request_id, (str, int)):
+            request_id = None
+        return _error_line(
+            request_id, INVALID_REQUEST, "Invalid Request: not a valid JSON-RPC 2.0 message"
+        )
+
+
+async def pump_input(lines: Any, read_stream_writer: Any, write_line: Callable[[str], Any]) -> None:
+    """Feed valid messages to the server; answer invalid lines directly."""
+    async with read_stream_writer:
+        async for line in lines:
+            parsed = parse_line(line)
+            if parsed is None:
+                continue
+            if isinstance(parsed, str):
+                await write_line(parsed)
+            else:
+                await read_stream_writer.send(parsed)
+
+
+async def pump_output(write_stream_reader: Any, write_line: Callable[[str], Any]) -> None:
+    async with write_stream_reader:
+        async for session_message in write_stream_reader:
+            await write_line(session_message.message.model_dump_json(by_alias=True, exclude_none=True))

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/src/sec_report_kit/mcp/server.py

@@ -268,10 +268,42 @@ def run_server(transport: str = "stdio", roots: Iterable[str | Path] | None = No
 
 
 async def _serve_stdio(mcp: Any) -> None:  # pragma: no cover - binds the real process stdin/stdout
-    from mcp.server.stdio import stdio_server
+    import sys
+    from io import TextIOWrapper
 
-    async with stdio_server() as (read_stream, write_stream):
-        await serve_streams(mcp, read_stream, write_stream)
+    import anyio
+
+    stdin = anyio.wrap_file(TextIOWrapper(sys.stdin.buffer, encoding="utf-8"))
+    stdout = anyio.wrap_file(TextIOWrapper(sys.stdout.buffer, encoding="utf-8"))
+
+    async def write_line(text: str) -> None:
+        await stdout.write(text + "\n")
+        await stdout.flush()
+
+    await serve_lines(mcp, stdin, write_line)
+
+
+async def serve_lines(mcp: Any, lines: Any, write_line: Any) -> None:
+    """Serve newline-delimited JSON-RPC from ``lines``, writing each response
+    line with ``write_line``. Replaces the SDK's stdio_server so that invalid
+    input gets a JSON-RPC error instead of being silently dropped."""
+    import anyio
+
+    from sec_report_kit.mcp.protocol import pump_input, pump_output
+
+    lock = anyio.Lock()
+
+    async def locked_write(text: str) -> None:
+        async with lock:
+            await write_line(text)
+
+    read_send, read_recv = anyio.create_memory_object_stream(0)
+    write_send, write_recv = anyio.create_memory_object_stream(0)
+    async with anyio.create_task_group() as tg:
+        tg.start_soon(pump_input, lines, read_send, locked_write)
+        tg.start_soon(pump_output, write_recv, locked_write)
+        async with write_send:
+            await serve_streams(mcp, read_recv, write_send)
 
 
 async def serve_streams(mcp: Any, read_stream: Any, write_stream: Any) -> None:

{sec_report_kit-0.7.0 → sec_report_kit-0.7.2}/tests/test_mcp_security.py

@@ -188,13 +188,37 @@ def test_validate_arguments_messages():
     assert "argument 'n' must be a integer, got bool" in problems
     assert "unexpected argument 'q' (allowed: a, n, x, z)" in problems
     assert len(problems) == 3
-    assert protocol.validate_arguments("t", schema, {"a": "ok", "n": None}) == []
+    assert protocol.validate_arguments("t", schema, {"a": "ok", "n": 3}) == []
+
+
+def test_validate_arguments_rejects_null_unless_schema_allows_it():
+    schema = {
+        "properties": {
+            "s": {"type": "string"},
+            "typed_null": {"type": ["string", "null"]},
+            "any_of_null": {"anyOf": [{"type": "string"}, {"type": "null"}]},
+            "untyped": {},
+        },
+    }
+    problems = protocol.validate_arguments(
+        "t", schema, {"s": None, "typed_null": None, "any_of_null": None, "untyped": None}
+    )
+    assert problems == [
+        "argument 's' must be a string, got null",
+        "argument 'untyped' must be a value, got null",
+    ]
+    assert protocol.validate_arguments("t", schema, {"typed_null": 5}) == [
+        "argument 'typed_null' must be a string, got int"
+    ]
 
 
 def test_server_rejects_extra_and_bad_args_cleanly(root):
     server = srv.build_server(roots=[root])
     is_error, text = _call(server, "summarize_json", {"source_type": "auto", "input_path": "scan.json", "bogus": 1})
     assert is_error and "unexpected argument 'bogus'" in text
+    is_error, text = _call(server, "summarize_json", {"source_type": None, "input_path": "scan.json"})
+    assert is_error and "argument 'source_type' must be a string, got null" in text
+    assert "pydantic" not in text and "input_value" not in text
     is_error, text = _call(server, "summarize_json", {"source_type": 5})
     assert is_error
     assert "missing required argument 'input_path'" in text
@@ -255,3 +279,69 @@ def test_serve_streams_answers_unknown_method_and_tool(root):
     result = responses[4]["result"]
     assert result.get("isError") is not True
     assert json.loads(result["content"][0]["text"])["total"] == 1
+
+
+# ---------- SR-006: invalid stdio input gets a JSON-RPC error ----------
+
+@pytest.mark.parametrize("line, expected_id, code", [
+    ("{not json", None, -32700),
+    ('{"jsonrpc": "2.0", "id": 3}', 3, -32600),
+    ('{"id": "abc", "method": "tools/list"}', "abc", -32600),
+    ('{"jsonrpc": "2.0", "id": true}', None, -32600),
+    ('{"jsonrpc": "2.0", "id": [1]}', None, -32600),
+    ('"just a string"', None, -32600),
+    ("[1, 2]", None, -32600),
+])
+def test_parse_line_invalid_input(line, expected_id, code):
+    reply = protocol.parse_line(line)
+    assert isinstance(reply, str)
+    data = json.loads(reply)
+    assert data["jsonrpc"] == "2.0" and data["id"] == expected_id and data["error"]["code"] == code
+
+
+def test_parse_line_valid_and_blank():
+    from mcp.shared.message import SessionMessage
+
+    assert protocol.parse_line("   \n") is None
+    msg = protocol.parse_line('{"jsonrpc": "2.0", "id": 1, "method": "ping"}')
+    assert isinstance(msg, SessionMessage)
+
+
+def test_serve_lines_end_to_end(root):
+    server = srv.build_server(roots=[root])
+    lines = [
+        json.dumps({"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {
+            "protocolVersion": "2025-06-18", "capabilities": {},
+            "clientInfo": {"name": "t", "version": "0"}}}),
+        json.dumps({"jsonrpc": "2.0", "method": "notifications/initialized"}),
+        "{broken",
+        "",
+        json.dumps({"jsonrpc": "2.0", "id": 7}),
+        json.dumps({"jsonrpc": "2.0", "id": 8, "method": "no/such"}),
+        json.dumps({"jsonrpc": "2.0", "id": 9, "method": "tools/call", "params": {
+            "name": "summarize_json", "arguments": {"source_type": None, "input_path": "scan.json"}}}),
+    ]
+    written: list[dict] = []
+
+    async def source():
+        for line in lines:
+            yield line + "\n"
+            await anyio.sleep(0.05)
+
+    async def write_line(text):
+        written.append(json.loads(text))
+
+    async def main():
+        with anyio.fail_after(30):
+            await srv.serve_lines(server, source(), write_line)
+
+    anyio.run(main)
+
+    by_id = {m.get("id", "none"): m for m in written}
+    assert by_id[1]["result"]["serverInfo"]["name"] == "sec-report-kit"
+    assert by_id[None]["error"]["code"] == -32700
+    assert by_id[7]["error"]["code"] == -32600
+    assert by_id[8]["error"]["code"] == -32601
+    text = by_id[9]["result"]["content"][0]["text"]
+    assert by_id[9]["result"]["isError"] and "got null" in text and "pydantic" not in text
+    assert len(written) == 5  # blank line produced nothing