shakerscan 0.1.0__tar.gz

shakerscan-0.1.0/.gitignore

@@ -0,0 +1,88 @@
+# Generated benchmark/test scratch output
+tests/benchmark/results/
+
+# Results (scan outputs, checkpoints, benchmark and planner-eval cards) are local-only. Release
+# benchmark cards are uploaded as certification artifacts and their digests are sealed into the
+# certified receipt attached to each GitHub Release; nothing under results/ belongs in git.
+results/
+
+# Environment
+.venv/
+venv/
+.env
+.env.local
+.env.*
+backups/
+.shakerscan-fleet/
+.shakerscan-model-intake-runner-stage/
+.shakerscan-local-build
+.shakerscan-local-build.tmp.*
+.shakerscan-build-receipt.json
+.shakerscan-build-receipt.json.tmp.*
+
+# Claude Code local settings
+.claude/settings.local.json
+.claude/projects/
+
+# Node
+node_modules/
+.next/
+*.tsbuildinfo
+ui/next-env.d.ts
+ui/test-results/
+ui/playwright-report/
+*.log
+bun.lockb
+
+# Python
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+*.egg-info/
+dist/
+build/
+.coverage
+htmlcov/
+coverage/
+
+# Docker
+*.tar
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Operator audit evidence (historical engineering ledgers are in Git history)
+audit-results/
+
+# Test-runner XML output from scripts/run_complete_python_suite.py
+artifacts/v2-*.xml
+
+# Operator data never belongs in the public source tree.
+/exports/
+/captures/
+/quarantine/
+/operator-data/
+*.har
+*.pcap
+*.pcapng
+*.sqlite
+*.sqlite3
+*.dump
+# Deliberately reviewed synthetic fixtures may be checked in.
+!tests/fixtures/**/*.har
+!tests/fixtures/**/*.pcap
+!tests/fixtures/**/*.pcapng
+
+# The shakerscan client (client/): build outputs, and the runtime modules vendored at build time.
+client/dist/
+client/build/
+client/src/shakerscan/_mcp.py
+client/src/shakerscan/_v2_cli.py

shakerscan-0.1.0/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.5
+Name: shakerscan
+Version: 0.1.0
+Summary: ShakerScan client: the MCP adapter and Hunt CLI for a ShakerScan instance, without the engine
+Project-URL: Homepage, https://shakerscan.com
+Project-URL: Source, https://github.com/andriyze/shakerscan
+Project-URL: Documentation, https://github.com/andriyze/shakerscan/blob/main/docs/client.md
+Author: ShakerScan
+License-Expression: AGPL-3.0-only
+Keywords: dast,hunt,mcp,pentest,security,shakerscan
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# shakerscan
+
+The ShakerScan client: the MCP adapter and the Hunt CLI for a ShakerScan instance, without the
+engine. Point it at a local engine, a VPS, or a self-hosted Enterprise gateway with a service
+token, and hand it to an agent (Claude Code, Codex, any MCP client) or to a script.
+
+```bash
+pipx install shakerscan          # or: uv tool install shakerscan
+shakerscan doctor --url https://scanner.example.com --token-file ./token
+shakerscan mcp    --url https://scanner.example.com --token-file ./token
+shakerscan hunt   --url https://scanner.example.com --token-file ./token list
+```
+
+It installs the same `shakerscan` command name as the engine installer
+(`curl -fsSL https://install.shakerscan.com | sh`): `mcp`, `hunt`, `doctor` and `version` work
+without Docker, and any engine subcommand (`start`, `stop`, `status`, `update`, ...) is handed to
+a local engine install when one exists. The adapter and CLI are the runtime's own code, vendored
+at build time, and the tools an agent sees come from the instance's live contracts.
+
+Python 3.10 or newer, no third-party dependencies, AGPL-3.0-only. Documentation:
+https://github.com/andriyze/shakerscan/blob/main/docs/client.md

shakerscan-0.1.0/README.md

@@ -0,0 +1,21 @@
+# shakerscan
+
+The ShakerScan client: the MCP adapter and the Hunt CLI for a ShakerScan instance, without the
+engine. Point it at a local engine, a VPS, or a self-hosted Enterprise gateway with a service
+token, and hand it to an agent (Claude Code, Codex, any MCP client) or to a script.
+
+```bash
+pipx install shakerscan          # or: uv tool install shakerscan
+shakerscan doctor --url https://scanner.example.com --token-file ./token
+shakerscan mcp    --url https://scanner.example.com --token-file ./token
+shakerscan hunt   --url https://scanner.example.com --token-file ./token list
+```
+
+It installs the same `shakerscan` command name as the engine installer
+(`curl -fsSL https://install.shakerscan.com | sh`): `mcp`, `hunt`, `doctor` and `version` work
+without Docker, and any engine subcommand (`start`, `stop`, `status`, `update`, ...) is handed to
+a local engine install when one exists. The adapter and CLI are the runtime's own code, vendored
+at build time, and the tools an agent sees come from the instance's live contracts.
+
+Python 3.10 or newer, no third-party dependencies, AGPL-3.0-only. Documentation:
+https://github.com/andriyze/shakerscan/blob/main/docs/client.md

shakerscan-0.1.0/hatch_build.py

@@ -0,0 +1,59 @@
+"""Vendor the runtime's MCP adapter and product CLI into the client at build time.
+
+The release runtime ships ``scripts/shakerscan_mcp.py`` (``scanner.sh mcp``) and
+``scripts/v2_cli.py`` (``scanner.sh hunt``) as standalone files. The client is that same code
+installed without the engine. Rather than committing copies that drift, the build maps them from
+the repository checkout into the package:
+
+- wheel: ``../scripts/shakerscan_mcp.py`` -> ``shakerscan/_mcp.py`` (and ``v2_cli.py`` -> ``_v2_cli.py``)
+- sdist: the same files under ``src/shakerscan/`` so a wheel built from the sdist carries them
+
+A wheel built from an unpacked sdist has no repository beside it; the copies are already in
+``src/`` and nothing is mapped. A build that can find neither fails rather than ship a client
+without its adapter.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+try:
+    from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+except ImportError:  # the pure helpers are importable (and tested) without a build backend
+    BuildHookInterface = object  # type: ignore[assignment,misc]
+
+VENDORED = {"shakerscan_mcp.py": "_mcp.py", "v2_cli.py": "_v2_cli.py"}
+REPOSITORY_MARKERS = ("VERSION", "scanner.sh")
+
+
+def repository_scripts(root: Path) -> Path | None:
+    """The repository's ``scripts/`` directory when ``root`` is ``<repo>/client``, else None."""
+    repo = Path(root).resolve().parent
+    if all((repo / marker).is_file() for marker in REPOSITORY_MARKERS) and (repo / "scripts").is_dir():
+        return repo / "scripts"
+    return None
+
+
+def plan_force_include(target_name: str, root: Path) -> dict[str, str]:
+    """Source path -> distribution path for the vendored runtime modules of one build target."""
+    root = Path(root)
+    prefix = "src/shakerscan/" if target_name == "sdist" else "shakerscan/"
+    scripts = repository_scripts(root)
+    if scripts is not None:
+        missing = [name for name in VENDORED if not (scripts / name).is_file()]
+        if missing:
+            raise RuntimeError(f"vendored runtime sources are missing from the repository: {missing}")
+        return {str(scripts / name): prefix + module for name, module in VENDORED.items()}
+    copies = [module for module in VENDORED.values() if (root / "src" / "shakerscan" / module).is_file()]
+    if len(copies) == len(VENDORED):
+        return {}
+    raise RuntimeError(
+        "vendored runtime sources not found: build from the repository checkout (../scripts) or "
+        "from an sdist that carries src/shakerscan/_mcp.py and src/shakerscan/_v2_cli.py"
+    )
+
+
+class CustomBuildHook(BuildHookInterface):  # type: ignore[misc]
+    def initialize(self, version: str, build_data: dict) -> None:  # noqa: ARG002
+        mapping = plan_force_include(self.target_name, Path(self.root))
+        build_data.setdefault("force_include", {}).update(mapping)

shakerscan-0.1.0/pyproject.toml

@@ -0,0 +1,42 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "shakerscan"
+dynamic = ["version"]
+description = "ShakerScan client: the MCP adapter and Hunt CLI for a ShakerScan instance, without the engine"
+readme = "README.md"
+license = "AGPL-3.0-only"
+requires-python = ">=3.10"
+authors = [{ name = "ShakerScan" }]
+keywords = ["shakerscan", "security", "dast", "pentest", "mcp", "hunt"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Information Technology",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://shakerscan.com"
+Source = "https://github.com/andriyze/shakerscan"
+Documentation = "https://github.com/andriyze/shakerscan/blob/main/docs/client.md"
+
+[project.scripts]
+shakerscan = "shakerscan.cli:main"
+
+[tool.hatch.version]
+path = "src/shakerscan/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/shakerscan"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/shakerscan", "README.md", "pyproject.toml", "hatch_build.py"]
+
+# Vendors the runtime's MCP adapter and product CLI into the package at build time (hatch_build.py).
+[tool.hatch.build.hooks.custom]

shakerscan-0.1.0/src/shakerscan/__init__.py

@@ -0,0 +1,3 @@
+"""ShakerScan client: the MCP adapter and Hunt CLI for a ShakerScan instance, without the engine."""
+
+__version__ = "0.1.0"

shakerscan-0.1.0/src/shakerscan/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())