Pricing

Pay per usage

Agent Security Scanner

Scan AI agent repos, MCP servers, and coding-agent configs for unsafe eval, shell execution, package hallucinations, prompt injection, and MCP security risks.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

ProofLayer

Actor stats

Bookmarked

Total users

Monthly active users

2 days ago

Last modified

[4.4.1] - 2026-05-19

Fixed

scan-project dotpath blind spot: the directory walk skipped every entry beginning with ., so security-relevant dotpaths (e.g. .github/workflows, .github/scripts) and their scannable source files were never analyzed. The blanket hidden-entry skip is replaced with an explicit SKIP_DIRECTORIES denylist. Scannable files inside dotpaths are now traversed, while VCS metadata (.git), dependency trees, build artifacts, language/tool caches, and editor state remain pruned. (#90, fixes #68)

[4.4.0] - 2026-05-12

Fixed

Packaging: src/semantic-integration.js, src/semantic-analyzer.js, src/utils/github-clone.js, and src/utils/npm-download.js are now included in the published tarball. Prior versions imported these files at runtime (from src/tools/scan-security.js and src/cli/scan-clawhub-full.js) but did not ship them, causing ERR_MODULE_NOT_FOUND when the package was installed globally and used via the composite GitHub Action.

Dependencies

chore(deps): bump fast-uri 3.1.0 → 3.1.2 (root, scanner-lite, mcp-server-full, prooflayer-scanner) (#82, #84, #83, #86)
chore(deps): bump hono 4.12.16 → 4.12.18 (root) and 4.12.14 → 4.12.18 (scanner-lite, mcp-server-full, prooflayer-scanner) (#85, #80, #79, #81)
chore(deps): bump ip-address 10.1.0 → 10.2.0 and express-rate-limit 8.3.0 → 8.5.1 (mcp-server-full, prooflayer-scanner) (#77, #78)

[4.3.0] - 2026-05-05

🔒 Critical Security Fixes

GitHub Action Security Hardening

CRITICAL FIX: GitHub composite action now fails closed instead of fail-open when scanner output is invalid (PR #71, fixes #67)
- Previously: Mixed stderr/stdout could corrupt JSON → parser silently defaulted to 0 issues → security gate incorrectly passed
- Now: Separates stdout (JSON) from stderr (logs), validates output strictly, exits with code 1 on any validation error
- Added scripts/parse_scan_results.py with comprehensive validation (file exists, valid JSON, correct schema, numeric counts, error detection)
- Added 9 regression tests covering all edge cases (malformed JSON, empty output, scanner errors, unrecognized schemas)
- Impact: Prevents security gates from being bypassed due to corrupted scanner output

Hono Framework Security Updates (8 CVEs Fixed)

CRITICAL: Updated Hono from 4.12.7 → 4.12.16 across all packages (PRs #66, #65, #64, #62, #75)
- GHSA-69xw-7hcm-h432: HTML injection via unvalidated JSX tag names in hono/jsx
- GHSA-9vqf-7f2p-gf9v: bodyLimit() bypass for chunked/unknown-length requests
- GHSA-458j-xx4x-4375: Improper JSX attribute name handling during SSR
- GHSA-wmmm-f939-6g9c: Middleware bypass via repeated slashes in serveStatic
- GHSA-xf4j-xp2r-rqqx: Path traversal in toSSG() allowing writes outside output directory
- GHSA-xpcf-pg52-r92g: IPv4-mapped IPv6 address bypass in ipRestriction()
- GHSA-26pp-8wgv-hjvm: Missing cookie name validation in setCookie()
- GHSA-r5rp-j6wh-rvv4: Cookie prefix bypass via non-breaking space in getCookie()

🐛 Bug Fixes

Confidence Filtering: Fixed case-insensitive confidence threshold filtering (PR #73, fixes #70)
- Semantic integration was emitting lowercase confidence: "medium" while config expected uppercase "MEDIUM"
- Now normalizes both confidence values and thresholds to uppercase before comparison
- Prevents security findings from being incorrectly filtered due to case mismatch
- Added 3 regression tests for lowercase/mixed-case scenarios
SARIF Conversion: Fixed full-project SARIF generation for GitHub Code Scanning (PR #72, fixes #69)
- Action's inline Python expected nested files[].issues[] but scan-project returns flat issues[]
- Added scripts/project_scan_to_sarif.py supporting both flat and nested schemas
- Separates stdout (JSON) from stderr (logs) to prevent parse failures
- Added 6 regression tests covering all schema variants and edge cases
- Impact: GitHub Security tab now correctly displays findings from full-project scans

📦 Dependency Updates

@hono/node-server: Updated to 1.19.13 across all packages (PRs #59, #58, #57, #56)
Vite: Updated to 7.3.2 for dev dependencies (PRs #55, #54, #53)
Lodash: Updated from 4.17.23 → 4.18.1 (PRs #52, #51)
PostCSS: Updated from 8.5.6 → 8.5.14 in scanner-lite (PR #74)
path-to-regexp: Updated from 8.3.0 → 8.4.0 in mcp-server-full (PR #49)
picomatch: Updated from 4.0.3 → 4.0.4 (PRs #47, #46)

🧪 Testing

Added: 9 new tests for parse_scan_results.py (fail-closed behavior)
Added: 6 new tests for project_scan_to_sarif.py (SARIF conversion)
Added: 3 new tests for confidence normalization
Total: 18 new regression tests ensuring critical bugs stay fixed
All tests passing: 420+ tests across 30+ test files

📊 Impact Summary

18 PRs merged: 3 critical bug fixes + 15 security dependency updates
8 Hono CVEs patched: Preventing XSS, path traversal, authentication bypass, and injection attacks
Fail-closed security: GitHub Actions no longer bypass security gates on malformed output
100% backward compatible: No breaking changes, safe to upgrade

[3.18.0] - 2026-03-06

🎯 Major Features

Semantic Code Analysis Layer

NEW: Control Flow Graph (CFG) builder detecting execution paths and dead code
NEW: Data Flow Graph (DFG) tracking variable assignments and taint propagation
NEW: Code Property Graph (CPG) combining CFG + DFG + AST for deep analysis
NEW: 52 semantic security rules detecting logic-level vulnerabilities:
- Missing authentication checks
- Race conditions and TOCTOU vulnerabilities
- Use-after-free patterns
- Logic contradictions
- Unreachable security checks
- Improper error handling
NEW: SemanticAnalyzer class with pattern matching engine
NEW: Integration with existing scan pipeline (AST + taint + semantic)

Files: src/semantic-analyzer.js (1,284 lines), src/semantic-integration.js (283 lines), rules/semantic-security.yaml (52 rules)

Impact: Detects 15-20% more vulnerabilities than pure AST/regex approaches, catching business logic flaws competitors miss

🐛 Bug Fixes

Path Validation: Improved error handling in scan-skill tool for better diagnostics:
- ENOENT errors now return "Path not found" instead of generic message
- ELOOP errors return "Symlink loop detected"
- EACCES errors return "Permission denied"
Test Coverage: Updated path traversal tests to handle all error variants

📚 Documentation

Reorganized: Moved CONTRIBUTING.md, SETUP.md, mcp-top25.md to docs/ folder
Removed: 9 obsolete planning/release documents
Cleaned: Removed 4 unused logo files
Added: Comprehensive semantic analysis documentation in docs/semantic-analysis.md
Updated: References to moved documentation files

🧪 Testing

NEW: Complete test suite for semantic analysis (CFG, DFG, CPG, pattern matching)
Added: 32 test files total (up from 28)
Coverage: 420+ tests across all features
All tests passing with improved path validation test coverage

🔧 Improvements

Better project organization with cleaner root directory
Improved documentation discoverability
Enhanced code property graph analysis capabilities
More specific error messages for path validation failures

[3.16.1] - 2026-02-28

🔧 Dependencies

Update rollup from 4.57.1 to 4.59.0 - Security improvement: bundle path validation to prevent path traversal attacks (PR #22)

[Unreleased]

📦 New Package: @prooflayer/scanner-lite v1.0.0

PR #21 introduces scanner-lite - a lightweight, MIT-licensed MCP security scanner positioned as a direct alternative to AgentAudit-MCP.

🌟 Highlights

OWASP Agentic Top 10 Complete Coverage - All 418 YAML rules + 33 JS rules tagged with ASI-01 through ASI-10 metadata
18 New Agent-Specific Rules - Memory poisoning, inter-agent communication, cascading failures, trust exploitation, rogue agents
Runtime MCP Inspector - Live JSON-RPC tool definition scanning with A-F grading
311 Passing Tests - 8 test files with 100% pass rate
GitHub Action Ready - Composite action + reusable workflow example
MIT Licensed - ~95KB compressed, fully offline-capable, zero Python dependencies

🆕 Features

OWASP Agentic Security Initiative Coverage:

ASI-01 Goal Hijacking & Prompt Injection (~80 rules)
ASI-02 Tool Misuse & Unsafe Execution (~60 rules)
ASI-03 Identity & Privilege Escalation (~30 rules)
ASI-04 Supply Chain & Dependency Risks (~15 rules)
ASI-05 Arbitrary Code Execution (~50 rules)
ASI-06 Memory Poisoning - 4 new rules (vector-store-injection, embedding-raw-input, rag-no-sanitization, persistent-memory-write)
ASI-07 Inter-Agent Communication - 3 new rules (http-no-tls, unvalidated-agent-message, broadcast-no-auth)
ASI-08 Cascading Failures - 4 new rules (missing-max-iterations, missing-timeout, recursive-agent-call, no-error-boundary)
ASI-09 Trust Exploitation - 3 new rules (auto-approve, disabled-guardrails, trust-all-sources)
ASI-10 Rogue Agents - 4 new rules (no-kill-switch, unrestricted-spawning, self-modification, unrestricted-tool-access)

Runtime MCP Inspector (src/inspector.js):

Connects to live MCP servers via JSON-RPC over stdio
Scans tool definitions for poisoning, spoofing, unicode attacks
Levenshtein distance name spoofing detection
A-F security grading
Available as inspect_mcp_server MCP tool + inspect CLI command

8 MCP Tools:

scan_security - 418 YAML rules across 13 languages
scan_mcp_server - MCP server audit
scan_agent_prompt - Prompt injection detection
check_package - Package hallucination detection
scan_packages - Bulk import scanning
fix_security - Auto-fix with 165 templates
deep_audit - Optional LLM analysis (5 providers)
inspect_mcp_server - NEW Runtime inspector

CLI Commands: scan, inspect, audit, check-package, prompt, download-data

GitHub Action: Composite action in scanner-lite/action.yml for CI/CD integration

🐛 Critical Bug Fixes

Regex engine (?i) flag - 216 patterns in agent-attacks.security.yaml were silently failing due to Python (?i) flag incompatibility with JavaScript regex. Fixed by stripping (?i) and using i flag.
Terraform detection - Added tf/hcl to language maps so .tf files now correctly load Terraform rules

📊 Test Coverage

311 tests across 8 files (100% pass rate)
New: inspector.test.js (27 tests)
Expanded: scanner.test.js (29→51), tool-poisoning.test.js (27→52), prompt-scanner.test.js (25→43), cli.test.js (18→33), fix-engine.test.js (11→29), llm-audit.test.js (25→47)

📦 Package Details

Name: @prooflayer/scanner-lite
Version: 1.0.0
License: MIT
Size: ~95KB compressed (vs 230KB for AgentAudit-MCP)
Dependencies: Only 2 runtime deps (@modelcontextprotocol/sdk, zod)
Location: scanner-lite/ subdirectory
Offline: Fully offline-capable, zero Python dependencies

📝 Competitive Positioning

Feature	scanner-lite	AgentAudit-MCP
License	MIT	AGPL-3.0
Rules	418 YAML + 33 JS	12 regex
OWASP Agentic Top 10	ASI-01 through ASI-10	None
Tests	311 (100% pass)	~30
Offline	Yes	No
Auto-fix	165 templates	None
SARIF	Yes	No
Size	~95KB	~230KB

🙏 Contributors

@Har1sh-k - PR #21 (2 commits, +19,415 additions, scanner-lite package, OWASP ASI coverage, MCP inspector, bug fixes)

[3.16.0] - 2026-02-26

🔒 MCP Scanner Hardening (9 New Detection Rules)

PR #20 adds comprehensive MCP manifest security scanning with schema-level inspection, cross-tool manipulation detection, and advanced obfuscation detection.

🆕 New Features

Schema-level injection detection - Scans inputSchema property descriptions, defaults, and enum values for injection phrases, shell commands, and hidden characters
- mcp.schema-description-injection (ERROR) - Detects injection language or hidden characters in property descriptions
- mcp.schema-suspicious-default (ERROR) - Flags suspicious default values containing shell commands, URLs, or injection patterns
- mcp.schema-open-additionalProperties (WARNING) - Flags additionalProperties: true with empty properties (accepts arbitrary hidden parameters)
Cross-tool manipulation detection - Prevents tools from hijacking LLM execution flow
- mcp.cross-tool-reference (ERROR) - Detects tool descriptions directing LLM to invoke other tools with action directives
- mcp.cross-tool-priority-override (ERROR) - Flags tools claiming execution priority or exclusivity
Statistical anomaly detection - Identifies outlier tool descriptions that may hide injected instructions
- mcp.description-length-anomaly (WARNING) - Uses z-score analysis (threshold >2.5) to flag unusually long descriptions in servers with 5+ tools
Suspicious URL detection - Prevents data exfiltration and callback channels
- mcp.description-suspicious-url (WARNING) - Flags external URLs in tool descriptions that LLM might follow
- mcp.description-tunneling-url (ERROR) - Detects dev/tunneling URLs (ngrok, serveo, localtunnel, webhook.site, etc.)
Nested base64 detection - Detects double-encoded injection attempts
- nested-base64 (ERROR) - Detects double-encoded base64 in prompts and re-scans decoded content

🐛 Bug Fixes

YAML rule paths filter support - Respects paths.include/exclude filters in analyzer.py, semgrep_loader.py, and rules/init.py
- Fixes false positives from use-escapexml rule (JSP-only) matching JavaScript template literals
- Added .scannerrc.yaml to suppress use-escapexml in this repo (no JSP files)
CI fork permission handling - Added continue-on-error: true to PR comment step for fork pull requests

📊 Test Coverage

17 new tests across 2 test suites (100% pass rate)
- 14 new tests in tests/scan-mcp.test.js (schema, cross-tool, anomaly, URL detection)
- 3 new tests in tests/scan-prompt.test.js (nested base64 detection)
No regressions - All 510+ existing tests pass (5 pre-existing failures in unrelated files)
CI passing - All 9 GitHub Actions checks green

🎯 Attack Vectors Mitigated

Schema poisoning - Hidden instructions in JSON schema metadata
Cross-tool chaining - Unauthorized tool call sequences
Statistical hiding - Outlier-length descriptions to bury injection
Data exfiltration - Tunneling URLs and callback channels
Double obfuscation - Nested base64 encoding to evade detection

📝 Files Changed (9 files, +573/-3 lines)

src/tools/scan-mcp.js (+186) - 3 new functions, 8 new rules, 2 recommendation blocks
src/tools/scan-prompt.js (+49) - Nested base64 decode-and-rescan
tests/scan-mcp.test.js (+243) - 14 comprehensive test cases
tests/scan-prompt.test.js (+30) - 3 nested base64 tests
analyzer.py (+45) - Path filter implementation
rules/__init__.py (+7) - Preserve paths metadata
semgrep_loader.py (+6) - Preserve paths metadata
.scannerrc.yaml (+6) - Suppress use-escapexml false positives
.github/actions/security-scan/action.yml (+1) - Fork permission fix

🙏 Contributors

@Har1sh-k - PR #20 (3 commits, scanner hardening, path filter fix, CI improvements)

[3.13.0] - 2026-02-24

🔒 Security

Update ajv from 8.17.1 to 8.18.0 - Fixes CVE-2025-69873 (ReDoS attacks mitigation) via configured RegExp engine with $data keyword (PRs #11, #14)
Update @modelcontextprotocol/sdk from 1.25.3 to 1.26.0 - Fixes GHSA-345p-7cg4-v4c7 (cross-client response data leak when sharing server/transport instances) (PRs #4, #9)

⚡ Performance

Update hono from 4.11.7 to 4.12.1 - Major router performance improvement (1.5x-2.0x faster) via trie-router optimization (PRs #17, #18)
AJV tree-shaking support - "sideEffects": false in package.json enables smaller bundle sizes
Hono context optimization - Fast path for c.json() matching c.text() optimization

📦 Dependencies

Update qs from 6.14.1 to 6.15.0 - Adds strictMerge option to wrap object/primitive conflicts in arrays, fixes duplicates option for bracket notation keys (PRs #10, #13)
MCP SDK improvements - OAuth client credentials providers scopes support, npm audit vulnerabilities resolved

🛠️ Changed

Hono new features: $path() method for client (returns path string instead of full URL), ApplyGlobalResponse type helper for RPC client
AJV bug fixes: Infinity and NaN now serialize to null correctly
QS improvements: strictMerge option, bracket notation handling

🐛 Fixed

All dependency security vulnerabilities addressed
Router performance bottlenecks resolved
Type export issues in Hono client fixed

[3.12.0] - 2026-02-23

🔒 Security Fixes (Critical)

Command Injection Prevention - Fixed command injection in VS Code extension via cp.execFile() (src/extension.ts:17) - prevents arbitrary code execution via malicious filenames - CVE-class vulnerability (PR #19, @Har1sh-k)
Path Traversal Prevention - Symlink rejection + double containment check prevents escaping allowed directories (src/tools/scan-skill.js:769-802) (PR #19, @Har1sh-k)

🛡️ Security Hardening

DoS Prevention - 1 MB SKILL.md cap, 100 KB prompt cap, 5 MB supporting files cap
Timeout Cancellation - AbortController + process.kill() for hung scans (120s limit)
Fail-Closed Design - Crashed scanners emit findings instead of silent success
Atomic Baseline Writes - Temp + rename with mode 0o600, prevents race conditions
Hash-Based Baselines - {slug}-{pathHash}.json prevents collision attacks
Frontmatter Stripping - Remove YAML metadata before prompt scanning
Comprehensive Rug Pull - Hash includes all supporting files, not just SKILL.md

🆕 New Features

4 New Action Types - cron, process_spawn, git, docker with 60+ detection rules (PR #19, @Har1sh-k)
- cron: Persistence (@reboot), high-frequency jobs, remote code exec
- process_spawn: Reverse shells, background daemons, privilege escalation
- git: Force push, hard reset, credential exposure, untrusted remotes
- docker: Privileged containers, host mounts, socket access, dangerous capabilities
Recursive File Walking - Scan supporting files up to 5 levels deep (max 50 files, 5 MB)
Manifest Scanning - Extract dependencies from package.json, requirements.txt, Cargo.toml, Gemfile
Extended Code Blocks - Tilde fences (~~~), Windows \r\n, powershell/ps1/bat/cmd/fish routing

🪟 Cross-Platform

Windows Python Resolution - New src/python.js with py -3 launcher support (PR #19, @Har1sh-k)
Windows Path Handling - Forward slashes in MCP config paths (PR #19, @Har1sh-k)

⚡ Performance

YAML Rule Caching - Cache parsed rules, reduces prompt scan overhead by ~50ms
Shared File Collection - Collect once, use in L3 and L5, eliminates redundant walks
Per-Layer Timing - Full verbosity includes timings_ms breakdown

🐛 Bug Fixes

CI False-Assurance - audit/harden stubs exit non-zero unless --allow-stub (PR #19, @Har1sh-k)
MCP Server Version - Read from package.json instead of hardcoded "1.0.0"
Health Tool Rename - clawproof_health → scanner_health (backward-compatible alias)
Test Fixes - Fixed 6 failures in init-codex and plugin-integration (PR #19, @Har1sh-k)

⚠️ Breaking Changes (Internal)

Baseline Filename Format - Changed to {slug}-{pathHash}.json - users may see rug-pull warnings on first scan after upgrade (old baselines won't match new format)

📦 Internal

Improved Deduplication - Dedupe key includes rule_id, source, file, line, matched_text
OpenClaw Workspace - Added ~/.openclaw/workspace/skills to allowed roots

🙏 Contributors

@Har1sh-k - PR #19 (17 commits, +955 additions, -169 deletions) - security hardening, Windows compatibility, new action types

[3.11.0] - 2026-02-23

Added

scan_skill MCP Tool - Scan AI agent skill files (SKILL.md) for prompt injection, jailbreaks, and security issues. Returns A-F security grade with 40+ detection patterns
ClawHub Ecosystem Scanning - New CLI commands for batch scanning: scan-clawhub, scan-clawhub-safe, scan-clawhub-full
Prompt Injection Detection - 15 patterns detecting "ignore previous instructions", role manipulation, system overrides, and privilege escalation attempts
Jailbreak Detection - 4 patterns for DAN mode, developer mode, pretend scenarios, and "no restrictions" attacks
Data Exfiltration Detection - External URL detection with trusted domain whitelist (github.com, npmjs.org, pypi.org, etc.) and base64 encoding detection
Hidden Instructions Detection - HTML comments and secret directives detection
Security Grading System - A-F grading based on point accumulation: A (0), B (1-10), C (11-25), D (26-50), F (51+)
ClawHub Security Reports - Published comprehensive security analysis of entire ClawHub ecosystem (777 skills scanned, 69.5% with issues, 21.2% Grade F, 4,129 patterns detected)
ClawProof Standalone Package - Standalone npm package (v1.0.0) for independent skill scanning with CLI: clawproof scan ./SKILL.md
CWE Mappings - All vulnerability detections now include Common Weakness Enumeration codes
Infrastructure Files - Docker-based scanning environment, GCP deployment scripts, remote scanning capabilities
New files: src/tools/scan-skill-prompt.js, src/cli/scan-clawhub.js, src/cli/scan-clawhub-safe.js, src/cli/scan-clawhub-full.js
New directory: clawhub-security-reports/ with comprehensive ecosystem analysis
New package: clawproof/ standalone npm package with 17 comprehensive tests

Changed

Added tar dependency for ClawHub package downloading
Suppressed regex warnings in analyzer.py for cleaner output
Updated .gitignore with generated ClawHub scan data exclusions
Enhanced README with ClawHub ecosystem scanning section

Fixed

None

Migration

No migration required. All changes are additive and backward compatible.
New features are opt-in via new scan_skill MCP tool and scan-clawhub CLI commands

[3.9.0] - 2026-02-17

Added

scan_mcp_server Tool - New tool to audit MCP server source code for security vulnerabilities. Returns A-F security grade with 24+ detection rules covering insecure patterns, overly broad permissions, hardcoded secrets, eval/exec usage, and MCP-specific attack vectors
Unicode / Homoglyph Poisoning Detection - Detects zero-width characters (U+200B/C/D, FEFF, 2060), bidirectional override characters (U+202A-202E), and Cyrillic/ASCII homoglyph substitutions (mcp.unicode-zero-width, mcp.unicode-bidi-override, mcp.unicode-homoglyph)
Tool Name Spoofing Detection - Levenshtein-distance comparison against 35 well-known MCP tool names; flags tool names ≤2 edits from known tools (e.g. readFi1e spoofing readFile) — covers Adversa AI TOP25 #9
Tool Description Injection Classifier - Detects imperative/injection-style language in tool descriptions (ignore previous, exfiltrate, override instructions, etc.) — covers Adversa AI TOP25 #2 #3
server.json Manifest Parsing - manifest: true parameter scans MCP manifest alongside source code, catching poisoning that lives in the manifest rather than source
Rug Pull Detection - update_baseline: true hashes each tool's name+description into .mcp-security-baseline.json; future scans alert with mcp.rug-pull-detected on any tool change (added, modified, or removed) — covers Adversa AI TOP25 #6
scan_agent_action Tool - Pre-execution safety check for concrete agent actions (bash, file_write, file_read, http_request, file_delete). Returns ALLOW/WARN/BLOCK. Lighter-weight than scan_agent_prompt for evaluating specific operations
29 new tests for scan_mcp_server (unicode poisoning, description injection, tool name spoofing, manifest parsing, rug pull — all 5 detection categories)

Changed

Root repo is now the canonical npm release source (mcp-server/ subdirectory removed — was a duplicate)
README updated: scan_mcp_server and scan_agent_action added to tools table (Tools count: 8 → 10), full reference sections added, Side Effects note updated

[3.8.0] - 2026-02-16

Added

Cross-File Taint Analysis: Tracks vulnerabilities across file boundaries with three-phase analysis (per-file, export summaries, cross-file propagation)
Project Context Discovery: Auto-detects frameworks (Express, Django, Flask, Spring Boot, Rails, etc.), security middleware (helmet, cors, DOMPurify), and auth libraries (passport, bcrypt, jsonwebtoken)
Layer 2 Security Review: New security-review skill for LLM-powered project-aware code analysis that verifies Layer 1 findings and catches logic bugs
Import Graph Resolution: New import-resolver.js with cycle detection, content-hash caching, and multi-language support (JS/TS, Python, Go)
Function Export Analysis: FunctionTaintSummary dataclass and analyze_function_exports() method in taint_analyzer.py
New MCP tool parameters: project_context and resolve_imports on scan_security
New files: skills/security-review.md, src/tools/project-context.js, src/tools/import-resolver.js, src/tools/scan-project.js
Comprehensive test coverage: 19 pytest tests (tests/cross_file_taint_test.py), 61 vitest tests (tests/import-resolver.test.js, tests/project-context.test.js)
Realistic Express app test fixture: tests/fixtures/express-app/

Changed

Enhanced cross_file_analyzer.py with export analysis (+437 lines)
Enhanced scan-security.js with project context and import graph integration
Updated CLAUDE.md with two-layer security analysis documentation

Fixed

Cross-file SQL injection detection when tainted input originates in different files
False positives reduced by understanding project-level defenses (framework protections, middleware)

[3.1.0] - 2026-02-10

Fixed

Bug 1: npm bloom filter now ships with the package (3.78M packages, 8.6MB)
Bug 2: detectLanguage() now supports .cs, .rs, .c, .cpp, .h, .hpp, .tf, .hcl, .yaml, .yml, .sql, and Dockerfile
Bug 3: Created mcp-server/rules/__init__.py with recursive os.walk() rule loading for subdirectory rules (csharp/, rust/, c/, etc.)
Bug 4: AST engine diagnostics — narrowed exception handler, added engine field to findings, stderr logging
Bug 5: Taint analysis verification — added taint finding logging and engine: 'taint' field
Bug 6: Cross-language secret fix templates via envVarReplacement() helper (Go, Java, PHP, Ruby, C#, Rust, C/C++)
Bug 7: sensitivity_level now has meaningful impact — wider multipliers (1.5x/0.5x) and threshold adjustments in determineAction()
Bug 8: list_package_stats now reports bloom filter status per ecosystem
Bug 9: previous_messages multi-turn escalation detection in scan_agent_prompt
Bug 10: scan_packages no longer reports "All packages verified" when packages are unknown

Added

envVarReplacement() helper for idiomatic env var access across 9 languages
Role-switching attack patterns in prompt injection rules (System: prefix, role reassignment)
npm bloom filter generation script (scripts/fetch-npm-packages.js)
Test fixtures: vuln-csharp.cs, vuln-rust.rs, vuln-go.go, test-packages-npm.js
Language detection tests, cross-language fix tests, sensitivity/multi-turn/role-switching prompt tests

Changed

Version bump from 2.0.4 to 3.1.0

[2.3.1] - 2026-02-06

Added

MIT LICENSE file (Copyright 2026 Sinewave AI)
MCP Registry manifest (server.json) for mcp-publisher submission
4 new keywords: zed, prompt-firewall, auto-fix, hallucination (38 total)

Changed

SEO-optimized package.json description (accurate counts: 359 rules, 4.3M+ packages)
Fixed author email format to npm canonical angle-bracket style
Added LICENSE and server.json to npm files array

[2.3.0] - 2026-02-06

Added

Vitest test framework with 51 tests across 7 test files
Test fixtures for Python, JavaScript vulnerabilities and clean files
GitHub Actions CI workflow (Node 18/20/22, Python 3.12)
CHANGELOG.md following Keep a Changelog format
Prerequisites section in README

Changed

Updated README with accurate package counts and rule counts
Updated package.json author field
Added test scripts to package.json

[2.2.0] - 2026-02-06

Added

risk_score and action metadata to all 13 generic.prompt.* rules
6 new jailbreak-roleplay patterns (pretend you're a hacker, act as a hacker, etc.)
5 new ignore-previous-instructions patterns (ignore the above and instead, forget everything above, etc.)
7 new base64-encoded-injection patterns (follow decoded instructions, known base64 fragments, etc.)
New rule: generic.prompt.security.codeblock-obfuscation (attacks hidden in code blocks)
New rule: generic.prompt.security.natural-language-exfiltration (data exfiltration via natural language)
Code block extraction preprocessing in scan_agent_prompt
Runtime base64 decode-and-rescan in scan_agent_prompt
6 new CATEGORY_WEIGHTS entries (prompt-injection-encoded, -context, -privilege, -multi-turn, -output, unknown)

Changed

Lowered RISK_THRESHOLDS: HIGH 70→65, MEDIUM 50→40, LOW 25→20
Bumped CATEGORY_WEIGHTS: prompt-injection-content 0.9→1.0, prompt-injection-jailbreak 0.85→1.0
Enhanced compound boosting: cross-category boost (0.15), mixed-severity boost (1.1x)

Fixed

Prompt injection detection rate improved from ~33% to 80%+

[2.1.0] - 2026-02-06

Fixed

check_package handler now calls isHallucinated() directly instead of short-circuiting on empty Set
scan_packages handler now maps packages through isHallucinated() instead of short-circuiting
Command injection vulnerability in runAnalyzer() - replaced execSync template string with execFileSync
Added bloom_filter flag and confidence level to check_package/scan_packages responses
Added unknown_count field to scan_packages response

Added

npm bloom filter (3.78M packages, 8.65MB) via generate-npm-bloom.js script
Flutter SDK packages to dart.txt: flutter, flutter_driver, flutter_localizations, flutter_test, flutter_web_plugins

[2.0.1] - 2026-01-15

Initial

MCP server with scan_security, fix_security, check_package, scan_packages, scan_agent_prompt tools
Package hallucination detection via bloom filters (pypi, rubygems) and text lists (dart, perl, raku, crates)
Prompt injection scanning with 13 generic.prompt rules
165+ security fix templates

[1.0.0] - 2025-12-01

Initial Release

Core security scanning engine with Python analyzer
YAML-based security rules (Python, JavaScript, Java, Go, Dockerfile, secrets)
MCP server with stdio transport

MCP Server Safety Scanner

civicdataworks/mcp-server-safety-scanner

Inspect public MCP/server GitHub repos for manifest/readme/package safety signals: tool scope, auth, secrets, shell/file/network language, and maintenance metadata.

Rowan Mercer

Crypto Token Rug Check — Honeypot & Security Scanner

agent_services/crypto-rug-check

Instant rug-pull risk scan for any token across 8 chains (Base, Ethereum, BSC, Solana & more). Honeypot simulation, ownership/mint checks, taxes, LP lock, holder concentration — one SAFE/WARN/DANGER verdict with a 0-100 risk score. Free data sources, no API keys needed.

Riley Craig

⚡ Convex Security Scanner - Find Public Leaks

renzomacar/convex-security-scanner

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer. -- By Renzo Madueno, https://rotatepilot.com

Renzo Madueno

🧭 Directus Security Scanner - Find Leaks

renzomacar/directus-security-scanner

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only. -- By Renzo Madueno, https://rotatepilot.com

Renzo Madueno

MCP Registry API — Server Metadata Export

tugelbay/multi-registry-mcp-intelligence

Search the official MCP Registry API and export server names, descriptions, versions, lifecycle status, repositories, and update dates as JSON or CSV.

Tugelbay Konabayev

DepGuard - Dependency Vulnerability Scanner

george.the.developer/depguard-dependency-vulnerability-scanner

Scan your dependencies for known vulnerabilities over OSV.dev and flag the ones CISA lists as actively exploited, so you patch the dangerous bugs first. Packages or a lockfile in, normalized vulnerability rows out. No API key, standby ready.

George Kioko

Open Source Software Supply Chain MCP Server

ryanclinton/open-source-software-supply-chain-mcp

OSS dependency risk and SBOM compliance intelligence for application security teams, engineering leadership, and procurement.

Ryan Clinton

DepGuard MCP — Dependency Vulnerability Scanner

snipr/depguard-mcp

MCP server that stops AI coding agents from installing vulnerable packages. Checks any package against OSV.dev, or scans an entire lockfile (npm, PyPI, Cargo, Go & more) in one call — with severity thresholds, banned packages and triaged-CVE waivers.

Snithin P R

NPM Package Health Enricher

nxv107/npm-package-health-enricher

Enrich npm packages with downloads, license, repository, freshness, maintainers, deprecation status, and practical health flags.

Navpreet Singh

NF Vulnerability Scanner — All-in-One Website Security Audit

nativefoundation-inc/vuln-scan-actor

The most comprehensive all-in-one website vulnerability scanner on Apify. Multi-engine security testing — active scanning, CVE detection, server misconfig checks, plus SPF/DMARC email-spoofing checks and leaked-secret scanning. Structured JSON report with severities and priority grades.

NativeFoundation, inc.

Agent Security Scanner

Changelog

[4.4.1] - 2026-05-19

Fixed

[4.4.0] - 2026-05-12

Fixed

Dependencies

[4.3.0] - 2026-05-05

🔒 Critical Security Fixes

GitHub Action Security Hardening

Hono Framework Security Updates (8 CVEs Fixed)

🐛 Bug Fixes

📦 Dependency Updates

🧪 Testing

📊 Impact Summary

[3.18.0] - 2026-03-06

🎯 Major Features

Semantic Code Analysis Layer

🐛 Bug Fixes

📚 Documentation

🧪 Testing

🔧 Improvements

[3.16.1] - 2026-02-28

🔧 Dependencies

[Unreleased]

📦 New Package: @prooflayer/scanner-lite v1.0.0

🌟 Highlights

🆕 Features

🐛 Critical Bug Fixes

📊 Test Coverage

📦 Package Details

📝 Competitive Positioning

🙏 Contributors

[3.16.0] - 2026-02-26

🔒 MCP Scanner Hardening (9 New Detection Rules)

🆕 New Features

🐛 Bug Fixes

📊 Test Coverage

🎯 Attack Vectors Mitigated

📝 Files Changed (9 files, +573/-3 lines)

🙏 Contributors

[3.13.0] - 2026-02-24

🔒 Security

⚡ Performance

📦 Dependencies

🛠️ Changed

🐛 Fixed

[3.12.0] - 2026-02-23

🔒 Security Fixes (Critical)

🛡️ Security Hardening

🆕 New Features

🪟 Cross-Platform

⚡ Performance

🐛 Bug Fixes

⚠️ Breaking Changes (Internal)

📦 Internal

🙏 Contributors

[3.11.0] - 2026-02-23

Added

Changed

Fixed

Migration

[3.9.0] - 2026-02-17

Added

Changed

[3.8.0] - 2026-02-16

Added

Changed

Fixed

[3.1.0] - 2026-02-10

Fixed

Added

Changed

[2.3.1] - 2026-02-06

Added

Changed

[2.3.0] - 2026-02-06

Added

Changed

[2.2.0] - 2026-02-06