Skip to content

CHANGELOG.md

Latest commit

 

History

History
477 lines (359 loc) · 26 KB

CHANGELOG.md

File metadata and controls

477 lines (359 loc) · 26 KB

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[3.18.0] - 2026-03-06

🎯 Major Features

Semantic Code Analysis Layer

  • NEW: Control Flow Graph (CFG) builder detecting execution paths and dead code
  • NEW: Data Flow Graph (DFG) tracking variable assignments and taint propagation
  • NEW: Code Property Graph (CPG) combining CFG + DFG + AST for deep analysis
  • NEW: 52 semantic security rules detecting logic-level vulnerabilities:
    • Missing authentication checks
    • Race conditions and TOCTOU vulnerabilities
    • Use-after-free patterns
    • Logic contradictions
    • Unreachable security checks
    • Improper error handling
  • NEW: SemanticAnalyzer class with pattern matching engine
  • NEW: Integration with existing scan pipeline (AST + taint + semantic)

Files: src/semantic-analyzer.js (1,284 lines), src/semantic-integration.js (283 lines), rules/semantic-security.yaml (52 rules)

Impact: Detects 15-20% more vulnerabilities than pure AST/regex approaches, catching business logic flaws competitors miss

🐛 Bug Fixes

  • Path Validation: Improved error handling in scan-skill tool for better diagnostics:
    • ENOENT errors now return "Path not found" instead of generic message
    • ELOOP errors return "Symlink loop detected"
    • EACCES errors return "Permission denied"
  • Test Coverage: Updated path traversal tests to handle all error variants

📚 Documentation

  • Reorganized: Moved CONTRIBUTING.md, SETUP.md, mcp-top25.md to docs/ folder
  • Removed: 9 obsolete planning/release documents
  • Cleaned: Removed 4 unused logo files
  • Added: Comprehensive semantic analysis documentation in docs/semantic-analysis.md
  • Updated: References to moved documentation files

🧪 Testing

  • NEW: Complete test suite for semantic analysis (CFG, DFG, CPG, pattern matching)
  • Added: 32 test files total (up from 28)
  • Coverage: 420+ tests across all features
  • All tests passing with improved path validation test coverage

🔧 Improvements

  • Better project organization with cleaner root directory
  • Improved documentation discoverability
  • Enhanced code property graph analysis capabilities
  • More specific error messages for path validation failures

[3.16.1] - 2026-02-28

🔧 Dependencies

  • Update rollup from 4.57.1 to 4.59.0 - Security improvement: bundle path validation to prevent path traversal attacks (PR #22)

[Unreleased]

📦 New Package: @prooflayer/scanner-lite v1.0.0

PR #21 introduces scanner-lite - a lightweight, MIT-licensed MCP security scanner positioned as a direct alternative to AgentAudit-MCP.

🌟 Highlights

  • OWASP Agentic Top 10 Complete Coverage - All 418 YAML rules + 33 JS rules tagged with ASI-01 through ASI-10 metadata
  • 18 New Agent-Specific Rules - Memory poisoning, inter-agent communication, cascading failures, trust exploitation, rogue agents
  • Runtime MCP Inspector - Live JSON-RPC tool definition scanning with A-F grading
  • 311 Passing Tests - 8 test files with 100% pass rate
  • GitHub Action Ready - Composite action + reusable workflow example
  • MIT Licensed - ~95KB compressed, fully offline-capable, zero Python dependencies

🆕 Features

OWASP Agentic Security Initiative Coverage:

  • ASI-01 Goal Hijacking & Prompt Injection (~80 rules)
  • ASI-02 Tool Misuse & Unsafe Execution (~60 rules)
  • ASI-03 Identity & Privilege Escalation (~30 rules)
  • ASI-04 Supply Chain & Dependency Risks (~15 rules)
  • ASI-05 Arbitrary Code Execution (~50 rules)
  • ASI-06 Memory Poisoning - 4 new rules (vector-store-injection, embedding-raw-input, rag-no-sanitization, persistent-memory-write)
  • ASI-07 Inter-Agent Communication - 3 new rules (http-no-tls, unvalidated-agent-message, broadcast-no-auth)
  • ASI-08 Cascading Failures - 4 new rules (missing-max-iterations, missing-timeout, recursive-agent-call, no-error-boundary)
  • ASI-09 Trust Exploitation - 3 new rules (auto-approve, disabled-guardrails, trust-all-sources)
  • ASI-10 Rogue Agents - 4 new rules (no-kill-switch, unrestricted-spawning, self-modification, unrestricted-tool-access)

Runtime MCP Inspector (src/inspector.js):

  • Connects to live MCP servers via JSON-RPC over stdio
  • Scans tool definitions for poisoning, spoofing, unicode attacks
  • Levenshtein distance name spoofing detection
  • A-F security grading
  • Available as inspect_mcp_server MCP tool + inspect CLI command

8 MCP Tools:

  1. scan_security - 418 YAML rules across 13 languages
  2. scan_mcp_server - MCP server audit
  3. scan_agent_prompt - Prompt injection detection
  4. check_package - Package hallucination detection
  5. scan_packages - Bulk import scanning
  6. fix_security - Auto-fix with 165 templates
  7. deep_audit - Optional LLM analysis (5 providers)
  8. inspect_mcp_server - NEW Runtime inspector

CLI Commands: scan, inspect, audit, check-package, prompt, download-data

GitHub Action: Composite action in scanner-lite/action.yml for CI/CD integration

🐛 Critical Bug Fixes

  • Regex engine (?i) flag - 216 patterns in agent-attacks.security.yaml were silently failing due to Python (?i) flag incompatibility with JavaScript regex. Fixed by stripping (?i) and using i flag.
  • Terraform detection - Added tf/hcl to language maps so .tf files now correctly load Terraform rules

📊 Test Coverage

  • 311 tests across 8 files (100% pass rate)
  • New: inspector.test.js (27 tests)
  • Expanded: scanner.test.js (29→51), tool-poisoning.test.js (27→52), prompt-scanner.test.js (25→43), cli.test.js (18→33), fix-engine.test.js (11→29), llm-audit.test.js (25→47)

📦 Package Details

  • Name: @prooflayer/scanner-lite
  • Version: 1.0.0
  • License: MIT
  • Size: ~95KB compressed (vs 230KB for AgentAudit-MCP)
  • Dependencies: Only 2 runtime deps (@modelcontextprotocol/sdk, zod)
  • Location: scanner-lite/ subdirectory
  • Offline: Fully offline-capable, zero Python dependencies

📝 Competitive Positioning

Feature scanner-lite AgentAudit-MCP
License MIT AGPL-3.0
Rules 418 YAML + 33 JS 12 regex
OWASP Agentic Top 10 ASI-01 through ASI-10 None
Tests 311 (100% pass) ~30
Offline Yes No
Auto-fix 165 templates None
SARIF Yes No
Size ~95KB ~230KB

🙏 Contributors

  • @Har1sh-k - PR #21 (2 commits, +19,415 additions, scanner-lite package, OWASP ASI coverage, MCP inspector, bug fixes)

[3.16.0] - 2026-02-26

🔒 MCP Scanner Hardening (9 New Detection Rules)

PR #20 adds comprehensive MCP manifest security scanning with schema-level inspection, cross-tool manipulation detection, and advanced obfuscation detection.

🆕 New Features

  • Schema-level injection detection - Scans inputSchema property descriptions, defaults, and enum values for injection phrases, shell commands, and hidden characters

    • mcp.schema-description-injection (ERROR) - Detects injection language or hidden characters in property descriptions
    • mcp.schema-suspicious-default (ERROR) - Flags suspicious default values containing shell commands, URLs, or injection patterns
    • mcp.schema-open-additionalProperties (WARNING) - Flags additionalProperties: true with empty properties (accepts arbitrary hidden parameters)

  • Cross-tool manipulation detection - Prevents tools from hijacking LLM execution flow

    • mcp.cross-tool-reference (ERROR) - Detects tool descriptions directing LLM to invoke other tools with action directives
    • mcp.cross-tool-priority-override (ERROR) - Flags tools claiming execution priority or exclusivity

  • Statistical anomaly detection - Identifies outlier tool descriptions that may hide injected instructions

    • mcp.description-length-anomaly (WARNING) - Uses z-score analysis (threshold >2.5) to flag unusually long descriptions in servers with 5+ tools

  • Suspicious URL detection - Prevents data exfiltration and callback channels

    • mcp.description-suspicious-url (WARNING) - Flags external URLs in tool descriptions that LLM might follow
    • mcp.description-tunneling-url (ERROR) - Detects dev/tunneling URLs (ngrok, serveo, localtunnel, webhook.site, etc.)

  • Nested base64 detection - Detects double-encoded injection attempts

    • nested-base64 (ERROR) - Detects double-encoded base64 in prompts and re-scans decoded content

🐛 Bug Fixes

  • YAML rule paths filter support - Respects paths.include/exclude filters in analyzer.py, semgrep_loader.py, and rules/init.py
    • Fixes false positives from use-escapexml rule (JSP-only) matching JavaScript template literals
    • Added .scannerrc.yaml to suppress use-escapexml in this repo (no JSP files)
  • CI fork permission handling - Added continue-on-error: true to PR comment step for fork pull requests

📊 Test Coverage

  • 17 new tests across 2 test suites (100% pass rate)
    • 14 new tests in tests/scan-mcp.test.js (schema, cross-tool, anomaly, URL detection)
    • 3 new tests in tests/scan-prompt.test.js (nested base64 detection)
  • No regressions - All 510+ existing tests pass (5 pre-existing failures in unrelated files)
  • CI passing - All 9 GitHub Actions checks green

🎯 Attack Vectors Mitigated

  • Schema poisoning - Hidden instructions in JSON schema metadata
  • Cross-tool chaining - Unauthorized tool call sequences
  • Statistical hiding - Outlier-length descriptions to bury injection
  • Data exfiltration - Tunneling URLs and callback channels
  • Double obfuscation - Nested base64 encoding to evade detection

📝 Files Changed (9 files, +573/-3 lines)

  • src/tools/scan-mcp.js (+186) - 3 new functions, 8 new rules, 2 recommendation blocks
  • src/tools/scan-prompt.js (+49) - Nested base64 decode-and-rescan
  • tests/scan-mcp.test.js (+243) - 14 comprehensive test cases
  • tests/scan-prompt.test.js (+30) - 3 nested base64 tests
  • analyzer.py (+45) - Path filter implementation
  • rules/__init__.py (+7) - Preserve paths metadata
  • semgrep_loader.py (+6) - Preserve paths metadata
  • .scannerrc.yaml (+6) - Suppress use-escapexml false positives
  • .github/actions/security-scan/action.yml (+1) - Fork permission fix

🙏 Contributors

  • @Har1sh-k - PR #20 (3 commits, scanner hardening, path filter fix, CI improvements)

[3.13.0] - 2026-02-24

🔒 Security

  • Update ajv from 8.17.1 to 8.18.0 - Fixes CVE-2025-69873 (ReDoS attacks mitigation) via configured RegExp engine with $data keyword (PRs #11, #14)
  • Update @modelcontextprotocol/sdk from 1.25.3 to 1.26.0 - Fixes GHSA-345p-7cg4-v4c7 (cross-client response data leak when sharing server/transport instances) (PRs #4, #9)

⚡ Performance

  • Update hono from 4.11.7 to 4.12.1 - Major router performance improvement (1.5x-2.0x faster) via trie-router optimization (PRs #17, #18)
  • AJV tree-shaking support - "sideEffects": false in package.json enables smaller bundle sizes
  • Hono context optimization - Fast path for c.json() matching c.text() optimization

📦 Dependencies

  • Update qs from 6.14.1 to 6.15.0 - Adds strictMerge option to wrap object/primitive conflicts in arrays, fixes duplicates option for bracket notation keys (PRs #10, #13)
  • MCP SDK improvements - OAuth client credentials providers scopes support, npm audit vulnerabilities resolved

🛠️ Changed

  • Hono new features: $path() method for client (returns path string instead of full URL), ApplyGlobalResponse type helper for RPC client
  • AJV bug fixes: Infinity and NaN now serialize to null correctly
  • QS improvements: strictMerge option, bracket notation handling

🐛 Fixed

  • All dependency security vulnerabilities addressed
  • Router performance bottlenecks resolved
  • Type export issues in Hono client fixed

[3.12.0] - 2026-02-23

🔒 Security Fixes (Critical)

  • Command Injection Prevention - Fixed command injection in VS Code extension via cp.execFile() (src/extension.ts:17) - prevents arbitrary code execution via malicious filenames - CVE-class vulnerability (PR #19, @Har1sh-k)
  • Path Traversal Prevention - Symlink rejection + double containment check prevents escaping allowed directories (src/tools/scan-skill.js:769-802) (PR #19, @Har1sh-k)

🛡️ Security Hardening

  • DoS Prevention - 1 MB SKILL.md cap, 100 KB prompt cap, 5 MB supporting files cap
  • Timeout Cancellation - AbortController + process.kill() for hung scans (120s limit)
  • Fail-Closed Design - Crashed scanners emit findings instead of silent success
  • Atomic Baseline Writes - Temp + rename with mode 0o600, prevents race conditions
  • Hash-Based Baselines - {slug}-{pathHash}.json prevents collision attacks
  • Frontmatter Stripping - Remove YAML metadata before prompt scanning
  • Comprehensive Rug Pull - Hash includes all supporting files, not just SKILL.md

🆕 New Features

  • 4 New Action Types - cron, process_spawn, git, docker with 60+ detection rules (PR #19, @Har1sh-k)
    • cron: Persistence (@reboot), high-frequency jobs, remote code exec
    • process_spawn: Reverse shells, background daemons, privilege escalation
    • git: Force push, hard reset, credential exposure, untrusted remotes
    • docker: Privileged containers, host mounts, socket access, dangerous capabilities
  • Recursive File Walking - Scan supporting files up to 5 levels deep (max 50 files, 5 MB)
  • Manifest Scanning - Extract dependencies from package.json, requirements.txt, Cargo.toml, Gemfile
  • Extended Code Blocks - Tilde fences (~~~), Windows \r\n, powershell/ps1/bat/cmd/fish routing

🪟 Cross-Platform

  • Windows Python Resolution - New src/python.js with py -3 launcher support (PR #19, @Har1sh-k)
  • Windows Path Handling - Forward slashes in MCP config paths (PR #19, @Har1sh-k)

⚡ Performance

  • YAML Rule Caching - Cache parsed rules, reduces prompt scan overhead by ~50ms
  • Shared File Collection - Collect once, use in L3 and L5, eliminates redundant walks
  • Per-Layer Timing - Full verbosity includes timings_ms breakdown

🐛 Bug Fixes

  • CI False-Assurance - audit/harden stubs exit non-zero unless --allow-stub (PR #19, @Har1sh-k)
  • MCP Server Version - Read from package.json instead of hardcoded "1.0.0"
  • Health Tool Rename - clawproof_health → scanner_health (backward-compatible alias)
  • Test Fixes - Fixed 6 failures in init-codex and plugin-integration (PR #19, @Har1sh-k)

⚠️ Breaking Changes (Internal)

  • Baseline Filename Format - Changed to {slug}-{pathHash}.json - users may see rug-pull warnings on first scan after upgrade (old baselines won't match new format)

📦 Internal

  • Improved Deduplication - Dedupe key includes rule_id, source, file, line, matched_text
  • OpenClaw Workspace - Added ~/.openclaw/workspace/skills to allowed roots

🙏 Contributors

  • @Har1sh-k - PR #19 (17 commits, +955 additions, -169 deletions) - security hardening, Windows compatibility, new action types

[3.11.0] - 2026-02-23

Added

  • scan_skill MCP Tool - Scan AI agent skill files (SKILL.md) for prompt injection, jailbreaks, and security issues. Returns A-F security grade with 40+ detection patterns
  • ClawHub Ecosystem Scanning - New CLI commands for batch scanning: scan-clawhub, scan-clawhub-safe, scan-clawhub-full
  • Prompt Injection Detection - 15 patterns detecting "ignore previous instructions", role manipulation, system overrides, and privilege escalation attempts
  • Jailbreak Detection - 4 patterns for DAN mode, developer mode, pretend scenarios, and "no restrictions" attacks
  • Data Exfiltration Detection - External URL detection with trusted domain whitelist (github.com, npmjs.org, pypi.org, etc.) and base64 encoding detection
  • Hidden Instructions Detection - HTML comments and secret directives detection
  • Security Grading System - A-F grading based on point accumulation: A (0), B (1-10), C (11-25), D (26-50), F (51+)
  • ClawHub Security Reports - Published comprehensive security analysis of entire ClawHub ecosystem (777 skills scanned, 69.5% with issues, 21.2% Grade F, 4,129 patterns detected)
  • ClawProof Standalone Package - Standalone npm package (v1.0.0) for independent skill scanning with CLI: clawproof scan ./SKILL.md
  • CWE Mappings - All vulnerability detections now include Common Weakness Enumeration codes
  • Infrastructure Files - Docker-based scanning environment, GCP deployment scripts, remote scanning capabilities
  • New files: src/tools/scan-skill-prompt.js, src/cli/scan-clawhub.js, src/cli/scan-clawhub-safe.js, src/cli/scan-clawhub-full.js
  • New directory: clawhub-security-reports/ with comprehensive ecosystem analysis
  • New package: clawproof/ standalone npm package with 17 comprehensive tests

Changed

  • Added tar dependency for ClawHub package downloading
  • Suppressed regex warnings in analyzer.py for cleaner output
  • Updated .gitignore with generated ClawHub scan data exclusions
  • Enhanced README with ClawHub ecosystem scanning section

Fixed

  • None

Migration

  • No migration required. All changes are additive and backward compatible.
  • New features are opt-in via new scan_skill MCP tool and scan-clawhub CLI commands

[3.9.0] - 2026-02-17

Added

  • scan_mcp_server Tool - New tool to audit MCP server source code for security vulnerabilities. Returns A-F security grade with 24+ detection rules covering insecure patterns, overly broad permissions, hardcoded secrets, eval/exec usage, and MCP-specific attack vectors
  • Unicode / Homoglyph Poisoning Detection - Detects zero-width characters (U+200B/C/D, FEFF, 2060), bidirectional override characters (U+202A-202E), and Cyrillic/ASCII homoglyph substitutions (mcp.unicode-zero-width, mcp.unicode-bidi-override, mcp.unicode-homoglyph)
  • Tool Name Spoofing Detection - Levenshtein-distance comparison against 35 well-known MCP tool names; flags tool names ≤2 edits from known tools (e.g. readFi1e spoofing readFile) — covers Adversa AI TOP25 #9
  • Tool Description Injection Classifier - Detects imperative/injection-style language in tool descriptions (ignore previous, exfiltrate, override instructions, etc.) — covers Adversa AI TOP25 #2 #3
  • server.json Manifest Parsing - manifest: true parameter scans MCP manifest alongside source code, catching poisoning that lives in the manifest rather than source
  • Rug Pull Detection - update_baseline: true hashes each tool's name+description into .mcp-security-baseline.json; future scans alert with mcp.rug-pull-detected on any tool change (added, modified, or removed) — covers Adversa AI TOP25 #6
  • scan_agent_action Tool - Pre-execution safety check for concrete agent actions (bash, file_write, file_read, http_request, file_delete). Returns ALLOW/WARN/BLOCK. Lighter-weight than scan_agent_prompt for evaluating specific operations
  • 29 new tests for scan_mcp_server (unicode poisoning, description injection, tool name spoofing, manifest parsing, rug pull — all 5 detection categories)

Changed

  • Root repo is now the canonical npm release source (mcp-server/ subdirectory removed — was a duplicate)
  • README updated: scan_mcp_server and scan_agent_action added to tools table (Tools count: 8 → 10), full reference sections added, Side Effects note updated

[3.8.0] - 2026-02-16

Added

  • Cross-File Taint Analysis: Tracks vulnerabilities across file boundaries with three-phase analysis (per-file, export summaries, cross-file propagation)
  • Project Context Discovery: Auto-detects frameworks (Express, Django, Flask, Spring Boot, Rails, etc.), security middleware (helmet, cors, DOMPurify), and auth libraries (passport, bcrypt, jsonwebtoken)
  • Layer 2 Security Review: New security-review skill for LLM-powered project-aware code analysis that verifies Layer 1 findings and catches logic bugs
  • Import Graph Resolution: New import-resolver.js with cycle detection, content-hash caching, and multi-language support (JS/TS, Python, Go)
  • Function Export Analysis: FunctionTaintSummary dataclass and analyze_function_exports() method in taint_analyzer.py
  • New MCP tool parameters: project_context and resolve_imports on scan_security
  • New files: skills/security-review.md, src/tools/project-context.js, src/tools/import-resolver.js, src/tools/scan-project.js
  • Comprehensive test coverage: 19 pytest tests (tests/cross_file_taint_test.py), 61 vitest tests (tests/import-resolver.test.js, tests/project-context.test.js)
  • Realistic Express app test fixture: tests/fixtures/express-app/

Changed

  • Enhanced cross_file_analyzer.py with export analysis (+437 lines)
  • Enhanced scan-security.js with project context and import graph integration
  • Updated CLAUDE.md with two-layer security analysis documentation

Fixed

  • Cross-file SQL injection detection when tainted input originates in different files
  • False positives reduced by understanding project-level defenses (framework protections, middleware)

[3.1.0] - 2026-02-10

Fixed

  • Bug 1: npm bloom filter now ships with the package (3.78M packages, 8.6MB)
  • Bug 2: detectLanguage() now supports .cs, .rs, .c, .cpp, .h, .hpp, .tf, .hcl, .yaml, .yml, .sql, and Dockerfile
  • Bug 3: Created mcp-server/rules/__init__.py with recursive os.walk() rule loading for subdirectory rules (csharp/, rust/, c/, etc.)
  • Bug 4: AST engine diagnostics — narrowed exception handler, added engine field to findings, stderr logging
  • Bug 5: Taint analysis verification — added taint finding logging and engine: 'taint' field
  • Bug 6: Cross-language secret fix templates via envVarReplacement() helper (Go, Java, PHP, Ruby, C#, Rust, C/C++)
  • Bug 7: sensitivity_level now has meaningful impact — wider multipliers (1.5x/0.5x) and threshold adjustments in determineAction()
  • Bug 8: list_package_stats now reports bloom filter status per ecosystem
  • Bug 9: previous_messages multi-turn escalation detection in scan_agent_prompt
  • Bug 10: scan_packages no longer reports "All packages verified" when packages are unknown

Added

  • envVarReplacement() helper for idiomatic env var access across 9 languages
  • Role-switching attack patterns in prompt injection rules (System: prefix, role reassignment)
  • npm bloom filter generation script (scripts/fetch-npm-packages.js)
  • Test fixtures: vuln-csharp.cs, vuln-rust.rs, vuln-go.go, test-packages-npm.js
  • Language detection tests, cross-language fix tests, sensitivity/multi-turn/role-switching prompt tests

Changed

  • Version bump from 2.0.4 to 3.1.0

[2.3.1] - 2026-02-06

Added

  • MIT LICENSE file (Copyright 2026 Sinewave AI)
  • MCP Registry manifest (server.json) for mcp-publisher submission
  • 4 new keywords: zed, prompt-firewall, auto-fix, hallucination (38 total)

Changed

  • SEO-optimized package.json description (accurate counts: 359 rules, 4.3M+ packages)
  • Fixed author email format to npm canonical angle-bracket style
  • Added LICENSE and server.json to npm files array

[2.3.0] - 2026-02-06

Added

  • Vitest test framework with 51 tests across 7 test files
  • Test fixtures for Python, JavaScript vulnerabilities and clean files
  • GitHub Actions CI workflow (Node 18/20/22, Python 3.12)
  • CHANGELOG.md following Keep a Changelog format
  • Prerequisites section in README

Changed

  • Updated README with accurate package counts and rule counts
  • Updated package.json author field
  • Added test scripts to package.json

[2.2.0] - 2026-02-06

Added

  • risk_score and action metadata to all 13 generic.prompt.* rules
  • 6 new jailbreak-roleplay patterns (pretend you're a hacker, act as a hacker, etc.)
  • 5 new ignore-previous-instructions patterns (ignore the above and instead, forget everything above, etc.)
  • 7 new base64-encoded-injection patterns (follow decoded instructions, known base64 fragments, etc.)
  • New rule: generic.prompt.security.codeblock-obfuscation (attacks hidden in code blocks)
  • New rule: generic.prompt.security.natural-language-exfiltration (data exfiltration via natural language)
  • Code block extraction preprocessing in scan_agent_prompt
  • Runtime base64 decode-and-rescan in scan_agent_prompt
  • 6 new CATEGORY_WEIGHTS entries (prompt-injection-encoded, -context, -privilege, -multi-turn, -output, unknown)

Changed

  • Lowered RISK_THRESHOLDS: HIGH 70→65, MEDIUM 50→40, LOW 25→20
  • Bumped CATEGORY_WEIGHTS: prompt-injection-content 0.9→1.0, prompt-injection-jailbreak 0.85→1.0
  • Enhanced compound boosting: cross-category boost (0.15), mixed-severity boost (1.1x)

Fixed

  • Prompt injection detection rate improved from ~33% to 80%+

[2.1.0] - 2026-02-06

Fixed

  • check_package handler now calls isHallucinated() directly instead of short-circuiting on empty Set
  • scan_packages handler now maps packages through isHallucinated() instead of short-circuiting
  • Command injection vulnerability in runAnalyzer() - replaced execSync template string with execFileSync
  • Added bloom_filter flag and confidence level to check_package/scan_packages responses
  • Added unknown_count field to scan_packages response

Added

  • npm bloom filter (3.78M packages, 8.65MB) via generate-npm-bloom.js script
  • Flutter SDK packages to dart.txt: flutter, flutter_driver, flutter_localizations, flutter_test, flutter_web_plugins

[2.0.1] - 2026-01-15

Initial

  • MCP server with scan_security, fix_security, check_package, scan_packages, scan_agent_prompt tools
  • Package hallucination detection via bloom filters (pypi, rubygems) and text lists (dart, perl, raku, crates)
  • Prompt injection scanning with 13 generic.prompt rules
  • 165+ security fix templates

[1.0.0] - 2025-12-01

Initial Release

  • Core security scanning engine with Python analyzer
  • YAML-based security rules (Python, JavaScript, Java, Go, Dockerfile, secrets)
  • MCP server with stdio transport