Fix readme file

CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.11.0 — 2026-08-27
+
+Ecosystem audit of public MCP servers turns up and fixes five precision bugs, plus a pre-commit hook and a VS Code extension scaffold for the distribution roadmap.
+
+### Fixed
+Found by scanning real third-party MCP servers (upstash/context7, cloudflare/mcp-server-cloudflare, stripe/agent-toolkit, awslabs/mcp):
+- **AI002** flagged secrets outside any LLM context (missing `llmFile` gate on the "secret" branch) — fired on a bcrypt hash logged in a plain demo app and a non-secret constant merely named with "KEY".
+- **isTestFilePath** didn't recognize `eval(s)` as a non-production path segment, so an LLM-as-judge eval harness (vitest-evals) was scanned as a real request handler.
+- **MCP001** compared a system-prompt string against a tainted variable name with a plain substring search instead of requiring a real identifier reference, producing a `proven`/critical false positive on prose that merely used the word "tools".
+- **MCP009/SKL003** cross-tool-reference detection resolved all 7 residual false positives by requiring the referenced tool name to sit between the trigger word and the verb (a redirect), not merely appear anywhere in the sentence (a normal "use X for Y" mention).
+
+### Added
+- **MCP011: untrusted tool source.** Flags an MCP tool handler that fetches from an external/unauthenticated source and returns the response as the tool result with no sanitization in between — the Sentry-MCP-DSN attack shape, where the tool server itself is the injection vector rather than the tool's static name/description (MCP007/MCP008).
+- **Pre-commit hook** (`.pre-commit-hooks.yaml`) — run this scanner as a pre-commit.com hook, catching findings before push instead of after.
+- **VS Code extension scaffold** (`vscode-extension/`) — wraps the CLI and reports findings as Problems-panel diagnostics; local-build install only, not yet published to the Marketplace.
+- Example compliance artifact (`docs/examples/THREAT_MODEL.example.md`) and a real terminal-recording demo.
+
+### Also
+- `docs/RealWorldFindings.md` updated with the full ecosystem-audit writeup.
+- Roadmap corrected on competitive positioning (Invariant Labs/MCP-Scan → Snyk Agent Scan).
+
 ## 0.10.0 — 2026-08-19
 
 Static config scanning for LiteLLM Proxy, plus six false-positive/robustness bugs found and fixed by adding a large real-world repo (BerriAI/litellm) to the regression gate.

README.md

@@ -101,7 +101,7 @@ If you already run Semgrep or GHAS, keep them — add SecureAI-Scan for the risk
 
 `secureai-scan scan .` end to end, real output against a real (small, deliberately vulnerable) file — [source](docs/demo-source):
 
-<img src="docs/demo.svg" alt="Terminal recording of secureai-scan scan . finding a traced prompt-injection vulnerability" width="700">
+<img src="docs/secure.gif" alt="Terminal recording of secureai-scan scan . finding a traced prompt-injection vulnerability" width="700">
 
 Attack shapes the scanner traces end to end:
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "secureai-scan",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "AST-based AI security scanner for TypeScript, JavaScript, and Python with dataflow evidence for prompt injection, MCP, Agent Skill, and RAG risks.",
   "author": "Akshay Kanthed",
   "license": "MIT",