From 427262ecdffc93ece5b8a5e52f69669c3d6a7910 Mon Sep 17 00:00:00 2001 From: akanthed Date: Thu, 27 Aug 2026 00:04:10 +0530 Subject: [PATCH] chore(release): bump version to 0.11.0 Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 20 ++++++++++++++++++++ package-lock.json | 6 ++++-- package.json | 2 +- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0dd814d..4c75632 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## 0.11.0 — 2026-08-27 + +Ecosystem audit of public MCP servers turns up and fixes five precision bugs, plus a pre-commit hook and a VS Code extension scaffold for the distribution roadmap. + +### Fixed +Found by scanning real third-party MCP servers (upstash/context7, cloudflare/mcp-server-cloudflare, stripe/agent-toolkit, awslabs/mcp): +- **AI002** flagged secrets outside any LLM context (missing `llmFile` gate on the "secret" branch) — fired on a bcrypt hash logged in a plain demo app and a non-secret constant merely named with "KEY". +- **isTestFilePath** didn't recognize `eval(s)` as a non-production path segment, so an LLM-as-judge eval harness (vitest-evals) was scanned as a real request handler. +- **MCP001** compared a system-prompt string against a tainted variable name with a plain substring search instead of requiring a real identifier reference, producing a `proven`/critical false positive on prose that merely used the word "tools". +- **MCP009/SKL003** cross-tool-reference detection resolved all 7 residual false positives by requiring the referenced tool name to sit between the trigger word and the verb (a redirect), not merely appear anywhere in the sentence (a normal "use X for Y" mention). + +### Added +- **Pre-commit hook** (`.pre-commit-hooks.yaml`) — run this scanner as a pre-commit.com hook, catching findings before push instead of after. +- **VS Code extension scaffold** (`vscode-extension/`) — wraps the CLI and reports findings as Problems-panel diagnostics; local-build install only, not yet published to the Marketplace. +- Example compliance artifact (`docs/examples/THREAT_MODEL.example.md`) and a real terminal-recording demo. + +### Also +- `docs/RealWorldFindings.md` updated with the full ecosystem-audit writeup. +- Roadmap corrected on competitive positioning (Invariant Labs/MCP-Scan → Snyk Agent Scan). + ## 0.10.0 — 2026-08-19 Static config scanning for LiteLLM Proxy, plus six false-positive/robustness bugs found and fixed by adding a large real-world repo (BerriAI/litellm) to the regression gate. diff --git a/package-lock.json b/package-lock.json index c327760..9ba605c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "secureai-scan", - "version": "0.10.0", + "version": "0.11.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "secureai-scan", - "version": "0.10.0", + "version": "0.11.0", "license": "MIT", "dependencies": { "commander": "^15.0.0", @@ -969,6 +969,7 @@ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", "license": "MIT", + "peer": true, "engines": { "node": ">=12" }, @@ -1108,6 +1109,7 @@ "integrity": "sha512-mrcEdkYtHfrK1A6fs3O6FxkBo0Qig5XUXqHhxUOQu0bmPo00QF4XaSx4edpazdHwxnSCjlGKGgIqWdaN4dvTLA==", "hasInstallScript": true, "license": "MIT", + "peer": true, "dependencies": { "node-addon-api": "^8.5.0", "node-gyp-build": "^4.8.4" diff --git a/package.json b/package.json index f1986b3..0ad8a0a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "secureai-scan", - "version": "0.10.0", + "version": "0.11.0", "description": "AST-based AI security scanner for TypeScript, JavaScript, and Python with dataflow evidence for prompt injection, MCP, Agent Skill, and RAG risks.", "author": "Akshay Kanthed", "license": "MIT",