Agent Security Scanner Mcp

New Features

AIVSS v2 Scoring Engine

• OWASP AI Vulnerability Scoring System implementation with per-finding scores (0-10)
• Deterministic formula: AIVSS = (0.25 × Base) + (0.45 × AI-Specific) + (0.30 × Impact)
• Heuristic auto-mapping from finding attributes (severity, category, confidence) to AIVSS metrics
• Manual override support for authoritative scoring
• Aggregate posture score with worst-case weighting

AIUC-1 Compliance Controls

• 16 controls (9 security, 7 safety) from the AIUC-1 framework
• Structured pass/partial/fail/not_evaluated evaluation per control
• Evidence requirements linking to specific scanner tools
• OWASP LLM Top 10 crosswalk for each control

New MCP Tools

• score_aivss — Score findings using OWASP AIVSS v2
• get_compliance_controls — Look up AIUC-1 compliance controls

Report CLI Extension

• --threat-model --json flag produces AIVSS posture + compliance output
• Threat model results saved to scan history for trend tracking

Finding Normalizer

• Unifies 6 different tool output shapes into consistent internal format
• Category inference from ruleId segments
• Severity mapping and confidence normalization

Bug Fixes

• Fixed path to test_ast_engine.py in CI workflow

Test Coverage

• 79 new tests across 4 test files
• 1404 total tests pass

Install

npm install -g [email protected]

Usage

# JSON report with threat model
node index.js report <dir> --threat-model --json

# Score findings via MCP tool
# (accepts output from any scanner tool)

# Look up compliance controls via MCP tool
# (returns structured evaluation criteria)

See docs/threat-model.md for full documentation.